comparison src/http/v2/ngx_http_v2.c @ 7561:9f1f9d6e056a

HTTP/2: discard remaining request body after redirect. Previously, if unbuffered request body reading wasn't finished before the request was redirected to a different location using error_page or X-Accel-Redirect, and the request body is read again, this could lead to disastrous effects, such as a duplicate post_handler call or "http request count is zero" alert followed by a segmentation fault. This happened in the following configuration (ticket #1819): location / { proxy_request_buffering off; proxy_pass http://bad; proxy_intercept_errors on; error_page 502 = /error; } location /error { proxy_pass http://backend; }
author Sergey Kandaurov <pluknet@nginx.com>
date Mon, 19 Aug 2019 15:16:06 +0300
parents 45415228990b
children 29b2dc731503
comparison
equal deleted inserted replaced
7560:2432a687e789 7561:9f1f9d6e056a
945 "skipping http2 DATA frame"); 945 "skipping http2 DATA frame");
946 946
947 return ngx_http_v2_state_skip_padded(h2c, pos, end); 947 return ngx_http_v2_state_skip_padded(h2c, pos, end);
948 } 948 }
949 949
950 r = stream->request;
951
952 if (r->reading_body && !r->request_body_no_buffering) {
953 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
954 "skipping http2 DATA frame");
955
956 return ngx_http_v2_state_skip_padded(h2c, pos, end);
957 }
958
950 size = end - pos; 959 size = end - pos;
951 960
952 if (size >= h2c->state.length) { 961 if (size >= h2c->state.length) {
953 size = h2c->state.length; 962 size = h2c->state.length;
954 stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG; 963 stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG;
955 } 964 }
956
957 r = stream->request;
958 965
959 if (r->request_body) { 966 if (r->request_body) {
960 rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed); 967 rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed);
961 968
962 if (rc != NGX_OK) { 969 if (rc != NGX_OK) {