diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2017-10-04 21:15:15 +0300 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2017-10-04 21:15:15 +0300 |
| commit | 328bfbe0d4653529362709920c388256c0a027e3 (patch) | |
| tree | ad824d73ed85337cb41c4ac105902c7b171a00ec /src | |
| parent | d07d598c28205d30907d011f5d3a3d81a929787c (diff) | |
| download | nginx-328bfbe0d4653529362709920c388256c0a027e3.tar.gz nginx-328bfbe0d4653529362709920c388256c0a027e3.tar.bz2 | |
HTTP/2: enforce writing the sync request body buffer to file.
The sync flag of HTTP/2 request body buffer is used when the size of request
body is unknown or bigger than configured "client_body_buffer_size". In this
case the buffer points to body data inside the global receive buffer that is
used for reading all HTTP/2 connections in the worker process. Thus, when the
sync flag is set, the buffer must be flushed to a temporary file, otherwise
the request body data can be overwritten.
Previously, the sync buffer wasn't flushed to a temporary file if the whole
body was received in one DATA frame with the END_STREAM flag and wasn't
copied into the HTTP/2 body preread buffer. As a result, the request body
might be corrupted (ticket #1384).
Now, setting r->request_body_in_file_only enforces writing the sync buffer
to a temporary file in all cases.
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/v2/ngx_http_v2.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c index a311de903..2c621907b 100644 --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c @@ -3589,11 +3589,6 @@ ngx_http_v2_read_request_body(ngx_http_request_t *r) rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); } else { - if (stream->preread) { - /* enforce writing preread buffer to file */ - r->request_body_in_file_only = 1; - } - rb->buf = ngx_calloc_buf(r->pool); if (rb->buf != NULL) { @@ -3694,6 +3689,8 @@ ngx_http_v2_process_request_body(ngx_http_request_t *r, u_char *pos, buf->pos = buf->start = pos; buf->last = buf->end = pos + size; + r->request_body_in_file_only = 1; + } else { if (size > (size_t) (buf->end - buf->last)) { ngx_log_error(NGX_LOG_INFO, fc->log, 0, |