# HG changeset patch
# User Igor Sysoev <igor@sysoev.ru>
# Date 1159687021 0
# Node ID 86862ad988da15a0dab7e1a283f26e9bec7d1fae
# Parent  1e9977fd34aad8ad5742f4cdcdf625ba3165e025
fix segfault when zero length file is PUT

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -34,6 +34,7 @@ ngx_http_read_client_request_body(ngx_ht
     ssize_t                    size;
     ngx_buf_t                 *b;
     ngx_chain_t               *cl, **next;
+    ngx_temp_file_t           *tf;
     ngx_http_request_body_t   *rb;
     ngx_http_core_loc_conf_t  *clcf;
 
@@ -49,7 +50,43 @@ ngx_http_read_client_request_body(ngx_ht
 
     r->request_body = rb;
 
-    if (r->headers_in.content_length_n <= 0) {
+    if (r->headers_in.content_length_n < 0) {
+        post_handler(r);
+        return NGX_OK;
+    }
+
+    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+
+    if (r->headers_in.content_length_n == 0) {
+
+        if (r->request_body_in_file_only) {
+            tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));
+            if (tf == NULL) {
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            }
+
+            tf->file.fd = NGX_INVALID_FILE;
+            tf->file.log = r->connection->log;
+            tf->path = clcf->client_body_temp_path;
+            tf->pool = r->pool;
+            tf->warn = "a client request body is buffered to a temporary file";
+            tf->log_level = r->request_body_file_log_level;
+            tf->persistent = r->request_body_in_persistent_file;
+
+            if (r->request_body_file_group_access) {
+                tf->mode = 0660;
+            }
+
+            rb->temp_file = tf;
+
+            if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,
+                                     tf->persistent, tf->mode)
+                != NGX_OK)
+            {
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            }
+        }
+
         post_handler(r);
         return NGX_OK;
     }
@@ -139,8 +176,6 @@ ngx_http_read_client_request_body(ngx_ht
         next = &rb->bufs;
     }
 
-    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
-
     size = clcf->client_body_buffer_size;
     size += size >> 2;