nginx-0.1.11-RELEASE importrelease-0.1.11

    *) Feature: the worker_priority directive.

    *) Change: both tcp_nopush and tcp_nodelay directives affect the
       transferred response.

    *) Bugfix: nginx did not call initgroups().
       Thanks to Andrew Sitnikov and Andrei Nigmatulin.

    *) Change: now the ngx_http_autoindex_module shows the file size in the
       bytes.

    *) Bugfix: the ngx_http_autoindex_module returned the 500 error if the
       broken symlink was in a directory.

    *) Bugfix: the files bigger than 4G could not be transferred using
       sendfile.

    *) Bugfix: if the backend was resolved to several backends and there
       was an error while the response waiting then process may got caught
       in an endless loop.

    *) Bugfix: the worker process may exit with the "unknown cycle" message
       when the /dev/poll method was used.

    *) Bugfix: "close() channel failed" errors.

    *) Bugfix: the autodetection of the "nobody" and "nogroup" groups.

    *) Bugfix: the send_lowat directive did not work on Linux.

    *) Bugfix: the segmentation fault occurred if there was no events
       section in configuration.

    *) Bugfix: nginx could not be built on OpenBSD.

    *) Bugfix: the double slashes in "://" in the URI were converted to
       ":/".

1 files changed, 16 insertions, 5 deletions

diff --git a/src/os/win32/ngx_wsasend_chain.c b/src/os/win32/ngx_wsasend_chain.c
index 1d75e0969..d5b1334a1 100644
--- a/src/os/win32/ngx_wsasend_chain.c
+++ b/src/os/win32/ngx_wsasend_chain.c
@@ -17,7 +17,7 @@ ngx_chain_t *ngx_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
 {
     int           rc;
     u_char       *prev;
-    u_long        size, sent, send, sprev;
+    u_long        size, sent, send, prev_send;
     ngx_uint_t    complete;
     ngx_err_t     err;
     ngx_event_t  *wev;
@@ -32,6 +32,12 @@ ngx_chain_t *ngx_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
         return in;
     }
 
+    /* the maximum limit size is the maximum u_long value - the page size */
+
+    if (limit == 0 || limit > NGX_MAX_UINT32_VALUE - ngx_pagesize) {
+        limit = NGX_MAX_UINT32_VALUE - ngx_pagesize;
+    }
+
     send = 0;
     complete = 0;
 
@@ -48,7 +54,7 @@ ngx_chain_t *ngx_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
     for ( ;; ) {
         prev = NULL;
         wsabuf = NULL;
-        sprev = send;
+        prev_send = send;
 
         vec.nelts = 0;
 
@@ -105,7 +111,7 @@ ngx_chain_t *ngx_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
                        "WSASend: fd:%d, s:%ul", c->fd, sent);
 
-        if (send - sprev == sent) {
+        if (send - prev_send == sent) {
             complete = 1;
         }
 
@@ -153,8 +159,7 @@ ngx_chain_t *ngx_overlapped_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
 {
     int               rc;
     u_char           *prev;
-    size_t            size;
-    u_long            send, sent;
+    u_long            size, send, sent;
     LPWSABUF          wsabuf;
     ngx_err_t         err;
     ngx_event_t      *wev;
@@ -175,6 +180,12 @@ ngx_chain_t *ngx_overlapped_wsasend_chain(ngx_connection_t *c, ngx_chain_t *in,
     if (!wev->complete) {
 
         /* post the overlapped WSASend() */
+
+        /* the maximum limit size is the maximum u_long value - the page size */
+
+        if (limit == 0 || limit > NGX_MAX_UINT32_VALUE - ngx_pagesize) {
+            limit = NGX_MAX_UINT32_VALUE - ngx_pagesize;
+        }
  
         /*
          * WSABUFs must be 4-byte aligned otherwise