Mercurial > hg > nginx

changeset 7623:72b792bb3885

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
HTTP/2: fixed socket leak with an incomplete HEADERS frame. A connection could get stuck without timers if a client has partially sent the HEADERS frame such that it was split on the individual header boundary. In this case, it cannot be processed without the rest of the HEADERS frame. The fix is to call ngx_http_v2_state_headers_save() in this case. Normally, it would be called from the ngx_http_v2_state_header_block() handler on the next iteration, when there is not enough data to continue processing. This isn't the case if recv_buffer became empty and there's no more data to read.
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 05 Feb 2020 16:29:23 +0300
parents 2955192fb210
children 1055e43e4fab
files src/http/v2/ngx_http_v2.c
diffstat 1 files changed, 7 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -1719,8 +1719,13 @@ ngx_http_v2_state_header_complete(ngx_ht
     ngx_http_v2_stream_t  *stream;
 
     if (h2c->state.length) {
-        h2c->state.handler = ngx_http_v2_state_header_block;
-        return pos;
+        if (end - pos > 0) {
+            h2c->state.handler = ngx_http_v2_state_header_block;
+            return pos;
+        }
+
+        return ngx_http_v2_state_headers_save(h2c, pos, end,
+                                              ngx_http_v2_state_header_block);
     }
 
     if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)) {