Fijxu/nginx-quic
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

HTTP/2: fixed socket leak with an incomplete HEADERS frame.

Browse source 
A connection could get stuck without timers if a client has partially sent
the HEADERS frame such that it was split on the individual header boundary.
In this case, it cannot be processed without the rest of the HEADERS frame.

The fix is to call ngx_http_v2_state_headers_save() in this case.  Normally,
it would be called from the ngx_http_v2_state_header_block() handler on the
next iteration, when there is not enough data to continue processing.  This
isn't the case if recv_buffer became empty and there's no more data to read.
This commit is contained in:
Sergey Kandaurov 2020-02-05 16:29:23 +03:00
parent 469054b2c9
commit 813e53b23d
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/http/v2/ngx_http_v2.c
View file

@ -1719,10 +1719,15 @@ ngx_http_v2_state_header_complete(ngx_http_v2_connection_t *h2c, u_char *pos,
ngx_http_v2_stream_t *stream;
if (h2c->state.length) {
if (end - pos > 0) {
h2c->state.handler = ngx_http_v2_state_header_block;
return pos;
}
return ngx_http_v2_state_headers_save(h2c, pos, end,
ngx_http_v2_state_header_block);
}
if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)) {
return ngx_http_v2_handle_continuation(h2c, pos, end,
ngx_http_v2_state_header_complete);