comparison src/http/v2/ngx_http_v2.c @ 7143:e532d397ca5e stable-1.12

HTTP/2: enforce writing the sync request body buffer to file. The sync flag of HTTP/2 request body buffer is used when the size of request body is unknown or bigger than configured "client_body_buffer_size". In this case the buffer points to body data inside the global receive buffer that is used for reading all HTTP/2 connections in the worker process. Thus, when the sync flag is set, the buffer must be flushed to a temporary file, otherwise the request body data can be overwritten. Previously, the sync buffer wasn't flushed to a temporary file if the whole body was received in one DATA frame with the END_STREAM flag and wasn't copied into the HTTP/2 body preread buffer. As a result, the request body might be corrupted (ticket #1384). Now, setting r->request_body_in_file_only enforces writing the sync buffer to a temporary file in all cases.
author Valentin Bartenev <vbart@nginx.com>
date Wed, 04 Oct 2017 21:15:15 +0300
parents 28dc369899ea
children
comparison
equal deleted inserted replaced
7142:b9d919b53593 7143:e532d397ca5e
3555 && !r->request_body_in_file_only) 3555 && !r->request_body_in_file_only)
3556 { 3556 {
3557 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); 3557 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len);
3558 3558
3559 } else { 3559 } else {
3560 if (stream->preread) {
3561 /* enforce writing preread buffer to file */
3562 r->request_body_in_file_only = 1;
3563 }
3564
3565 rb->buf = ngx_calloc_buf(r->pool); 3560 rb->buf = ngx_calloc_buf(r->pool);
3566 3561
3567 if (rb->buf != NULL) { 3562 if (rb->buf != NULL) {
3568 rb->buf->sync = 1; 3563 rb->buf->sync = 1;
3569 } 3564 }
3657 3652
3658 if (size) { 3653 if (size) {
3659 if (buf->sync) { 3654 if (buf->sync) {
3660 buf->pos = buf->start = pos; 3655 buf->pos = buf->start = pos;
3661 buf->last = buf->end = pos + size; 3656 buf->last = buf->end = pos + size;
3657
3658 r->request_body_in_file_only = 1;
3662 3659
3663 } else { 3660 } else {
3664 if (size > (size_t) (buf->end - buf->last)) { 3661 if (size > (size_t) (buf->end - buf->last)) {
3665 ngx_log_error(NGX_LOG_INFO, fc->log, 0, 3662 ngx_log_error(NGX_LOG_INFO, fc->log, 0,
3666 "client intended to send body data " 3663 "client intended to send body data "