[nginx] HTTP/2: enforce writing the sync request body buffer to file.
details: http://hg.nginx.org/nginx/rev/e532d397ca5e branches: stable-1.12 changeset: 7143:e532d397ca5e user: Valentin Bartenevdate: Wed Oct 04 21:15:15 2017 +0300 description: HTTP/2: enforce writing the sync request body buffer to file. The sync flag of HTTP/2 request body buffer is used when the size of request body is unknown or bigger than configured "client_body_buffer_size". In this case the buffer points to body data inside the global receive buffer that is used for reading all HTTP/2 connections in the worker process. Thus, when the sync flag is set, the buffer must be flushed to a temporary file, otherwise the request body data can be overwritten. Previously, the sync buffer wasn't flushed to a temporary file if the whole body was received in one DATA frame with the END_STREAM flag and wasn't copied into the HTTP/2 body preread buffer. As a result, the request body might be corrupted (ticket #1384). Now, setting r->request_body_in_file_only enforces writing the sync buffer to a temporary file in all cases. diffstat: src/http/v2/ngx_http_v2.c | 7 ++- 1 files changed, 2 insertions(+), 5 deletions(-) diffs (24 lines): diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c --- a/src/http/v2/ngx_http_v2.c +++ b/src/http/v2/ngx_http_v2.c @@ -3557,11 +3557,6 @@ ngx_http_v2_read_request_body(ngx_http_r rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); } else { -if (stream->preread) { -/* enforce writing preread buffer to file */ -r->request_body_in_file_only = 1; -} - rb->buf = ngx_calloc_buf(r->pool); if (rb->buf != NULL) { @@ -3660,6 +3655,8 @@ ngx_http_v2_process_request_body(ngx_htt buf->pos = buf->start = pos; buf->last = buf->end = pos + size; +r->request_body_in_file_only = 1; + } else { if (size > (size_t) (buf->end - buf->last)) { ngx_log_error(NGX_LOG_INFO, fc->log, 0, ___ nginx-devel mailing list nginx-devel@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx-devel
[nginx] HTTP/2: enforce writing the sync request body buffer to file.
details: http://hg.nginx.org/nginx/rev/b6dc472299da branches: changeset: 7118:b6dc472299da user: Valentin Bartenevdate: Wed Oct 04 21:15:15 2017 +0300 description: HTTP/2: enforce writing the sync request body buffer to file. The sync flag of HTTP/2 request body buffer is used when the size of request body is unknown or bigger than configured "client_body_buffer_size". In this case the buffer points to body data inside the global receive buffer that is used for reading all HTTP/2 connections in the worker process. Thus, when the sync flag is set, the buffer must be flushed to a temporary file, otherwise the request body data can be overwritten. Previously, the sync buffer wasn't flushed to a temporary file if the whole body was received in one DATA frame with the END_STREAM flag and wasn't copied into the HTTP/2 body preread buffer. As a result, the request body might be corrupted (ticket #1384). Now, setting r->request_body_in_file_only enforces writing the sync buffer to a temporary file in all cases. diffstat: src/http/v2/ngx_http_v2.c | 7 ++- 1 files changed, 2 insertions(+), 5 deletions(-) diffs (24 lines): diff -r dbd77a638eb7 -r b6dc472299da src/http/v2/ngx_http_v2.c --- a/src/http/v2/ngx_http_v2.c Tue Oct 03 18:19:27 2017 +0300 +++ b/src/http/v2/ngx_http_v2.c Wed Oct 04 21:15:15 2017 +0300 @@ -3589,11 +3589,6 @@ ngx_http_v2_read_request_body(ngx_http_r rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); } else { -if (stream->preread) { -/* enforce writing preread buffer to file */ -r->request_body_in_file_only = 1; -} - rb->buf = ngx_calloc_buf(r->pool); if (rb->buf != NULL) { @@ -3694,6 +3689,8 @@ ngx_http_v2_process_request_body(ngx_htt buf->pos = buf->start = pos; buf->last = buf->end = pos + size; +r->request_body_in_file_only = 1; + } else { if (size > (size_t) (buf->end - buf->last)) { ngx_log_error(NGX_LOG_INFO, fc->log, 0, ___ nginx-devel mailing list nginx-devel@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx-devel