Mercurial > hg > nginx
comparison src/http/v2/ngx_http_v2.c @ 7561:9f1f9d6e056a
HTTP/2: discard remaining request body after redirect.
Previously, if unbuffered request body reading wasn't finished before
the request was redirected to a different location using error_page
or X-Accel-Redirect, and the request body is read again, this could
lead to disastrous effects, such as a duplicate post_handler call or
"http request count is zero" alert followed by a segmentation fault.
This happened in the following configuration (ticket #1819):
location / {
proxy_request_buffering off;
proxy_pass http://bad;
proxy_intercept_errors on;
error_page 502 = /error;
}
location /error {
proxy_pass http://backend;
}
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Mon, 19 Aug 2019 15:16:06 +0300 |
parents | 45415228990b |
children | 29b2dc731503 |
comparison
equal
deleted
inserted
replaced
7560:2432a687e789 | 7561:9f1f9d6e056a |
---|---|
945 "skipping http2 DATA frame"); | 945 "skipping http2 DATA frame"); |
946 | 946 |
947 return ngx_http_v2_state_skip_padded(h2c, pos, end); | 947 return ngx_http_v2_state_skip_padded(h2c, pos, end); |
948 } | 948 } |
949 | 949 |
950 r = stream->request; | |
951 | |
952 if (r->reading_body && !r->request_body_no_buffering) { | |
953 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0, | |
954 "skipping http2 DATA frame"); | |
955 | |
956 return ngx_http_v2_state_skip_padded(h2c, pos, end); | |
957 } | |
958 | |
950 size = end - pos; | 959 size = end - pos; |
951 | 960 |
952 if (size >= h2c->state.length) { | 961 if (size >= h2c->state.length) { |
953 size = h2c->state.length; | 962 size = h2c->state.length; |
954 stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG; | 963 stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG; |
955 } | 964 } |
956 | |
957 r = stream->request; | |
958 | 965 |
959 if (r->request_body) { | 966 if (r->request_body) { |
960 rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed); | 967 rc = ngx_http_v2_process_request_body(r, pos, size, stream->in_closed); |
961 | 968 |
962 if (rc != NGX_OK) { | 969 if (rc != NGX_OK) { |