Mercurial > hg > nginx

comparison src/http/ngx_http_request_body.c @ 4936:240e3fb392c9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Request body: error checking fixes, negative rb->rest handling. Negative rb->rest can't happen with current code, but it's good to have it handled anyway. Found by Coverity (CID 744846, 744847, 744848).
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 26 Nov 2012 18:01:08 +0000
parents 7bd1c839af3b
children 3b6594a2b79f
comparison
equal deleted inserted replaced
4935:7bd1c839af3b 4936:240e3fb392c9
132 post_handler(r); 132 post_handler(r);
133 133
134 return NGX_OK; 134 return NGX_OK;
135 } 135 }
136 136
137 if (rb->rest < 0) {
138 ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
139 "negative request body rest");
140 rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
141 goto done;
142 }
143
137 clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module); 144 clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
138 145
139 size = clcf->client_body_buffer_size; 146 size = clcf->client_body_buffer_size;
140 size += size >> 2; 147 size += size >> 2;
141 148
641 if (rb == NULL) { 648 if (rb == NULL) {
642 return NGX_HTTP_INTERNAL_SERVER_ERROR; 649 return NGX_HTTP_INTERNAL_SERVER_ERROR;
643 } 650 }
644 651
645 rb->chunked = ngx_pcalloc(r->pool, sizeof(ngx_http_chunked_t)); 652 rb->chunked = ngx_pcalloc(r->pool, sizeof(ngx_http_chunked_t));
646 if (rb == NULL) { 653 if (rb->chunked == NULL) {
647 return NGX_HTTP_INTERNAL_SERVER_ERROR; 654 return NGX_HTTP_INTERNAL_SERVER_ERROR;
648 } 655 }
649 656
650 r->request_body = rb; 657 r->request_body = rb;
651 } 658 }
1020 1027
1021 #endif 1028 #endif
1022 1029
1023 /* TODO: coalesce neighbouring buffers */ 1030 /* TODO: coalesce neighbouring buffers */
1024 1031
1025 ngx_chain_add_copy(r->pool, &rb->bufs, in); 1032 if (ngx_chain_add_copy(r->pool, &rb->bufs, in) != NGX_OK) {
1033 return NGX_HTTP_INTERNAL_SERVER_ERROR;
1034 }
1026 1035
1027 return NGX_OK; 1036 return NGX_OK;
1028 } 1037 }