changeset 8219:1307308c3cf1 quic

Temporary fix for header null-termination in HTTP/3.
author Roman Arutyunyan <arut@nginx.com>
date Sat, 14 Mar 2020 13:18:55 +0300
parents 33feac1e57ac
children 7ada2feeac18
files src/http/ngx_http_request.c src/http/v3/ngx_http_v3_request.c
diffstat 2 files changed, 14 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1547,11 +1547,11 @@ ngx_http_process_request_headers(ngx_eve
 
             h->key.len = r->header_name_end - r->header_name_start;
             h->key.data = r->header_name_start;
-            //h->key.data[h->key.len] = '\0';
+            h->key.data[h->key.len] = '\0';
 
             h->value.len = r->header_end - r->header_start;
             h->value.data = r->header_start;
-            //h->value.data[h->value.len] = '\0';
+            h->value.data[h->value.len] = '\0';
 
             h->lowcase_key = ngx_pnalloc(r->pool, h->key.len);
             if (h->lowcase_key == NULL) {
--- a/src/http/v3/ngx_http_v3_request.c
+++ b/src/http/v3/ngx_http_v3_request.c
@@ -518,6 +518,18 @@ done:
         }
     }
 
+    /* XXX ugly reallocation for the trailing '\0' */
+
+    p = ngx_pnalloc(c->pool, name.len + value.len + 2);
+    if (p == NULL) {
+        return NGX_ERROR;
+    }
+
+    ngx_memcpy(p, name.data, name.len);
+    name.data = p;
+    ngx_memcpy(p + name.len + 1, value.data, value.len);
+    value.data = p + name.len + 1;
+
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
                    "http3 header \"%V\":\"%V\"", &name, &value);