Mercurial > hg > nginx

comparison src/http/v3/ngx_http_v3_request.c @ 9027:f9d7930d0eed quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
HTTP/3: skip empty request body buffers (ticket #2374). When client DATA frame header and its content come in different QUIC packets, it may happen that only the header is processed by the first ngx_http_v3_request_body_filter() call. In this case an empty request body buffer is added to r->request_body->bufs, which is later reused in a subsequent ngx_http_v3_request_body_filter() call without being removed from the body chain. As a result, rb->request_body->bufs ends up with two copies of the same buffer. The fix is to avoid adding empty request body buffers to r->request_body->bufs.
author Roman Arutyunyan <arut@nginx.com>
date Wed, 03 Aug 2022 16:59:51 +0400
parents 10522e8dea41
children 0f5fc7a320db
comparison
equal deleted inserted replaced
9026:3550b00d9dc8 9027:f9d7930d0eed
1550 if (rc == NGX_ERROR) { 1550 if (rc == NGX_ERROR) {
1551 return NGX_HTTP_INTERNAL_SERVER_ERROR; 1551 return NGX_HTTP_INTERNAL_SERVER_ERROR;
1552 } 1552 }
1553 1553
1554 /* rc == NGX_OK */ 1554 /* rc == NGX_OK */
1555 } 1555
1556 1556 if (max != -1 && (uint64_t) (max - rb->received) < st->length) {
1557 if (max != -1 && (uint64_t) (max - rb->received) < st->length) { 1557 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
1558 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, 1558 "client intended to send too large "
1559 "client intended to send too large " 1559 "body: %O+%ui bytes",
1560 "body: %O+%ui bytes", 1560 rb->received, st->length);
1561 rb->received, st->length); 1561
1562 1562 return NGX_HTTP_REQUEST_ENTITY_TOO_LARGE;
1563 return NGX_HTTP_REQUEST_ENTITY_TOO_LARGE; 1563 }
1564
1565 continue;
1564 } 1566 }
1565 1567
1566 if (b 1568 if (b
1567 && st->length <= 128 1569 && st->length <= 128
1568 && (uint64_t) (cl->buf->last - cl->buf->pos) >= st->length) 1570 && (uint64_t) (cl->buf->last - cl->buf->pos) >= st->length)