diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2016-11-28 19:19:21 +0300 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2016-11-28 19:19:21 +0300 |
| commit | f43e18807de8aeb02ef73d17f7889ae2d791a7ac (patch) | |
| tree | 54d336533e8bdc834cb938a29c92d9b585b3ab0c /src | |
| parent | 8c520c96212bb53fed4656f9e2bcc774c957e795 (diff) | |
| download | nginx-f43e18807de8aeb02ef73d17f7889ae2d791a7ac.tar.gz nginx-f43e18807de8aeb02ef73d17f7889ae2d791a7ac.tar.bz2 | |
HTTP/2: fixed saving preread buffer to temp file (ticket #1143).
Previously, a request body bigger than "client_body_buffer_size" wasn't written
into a temporary file if it has been pre-read entirely. The preread buffer
is freed after processing, thus subsequent use of it might result in sending
corrupted body or cause a segfault.
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/v2/ngx_http_v2.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c index 18f891b11..93f1a6d8e 100644 --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c @@ -3560,6 +3560,9 @@ ngx_http_v2_read_request_body(ngx_http_request_t *r, rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); } else { + /* enforce writing body to file */ + r->request_body_in_file_only = 1; + rb->buf = ngx_calloc_buf(r->pool); if (rb->buf != NULL) { |