mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-12 18:29:00 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Request body: avoid linking rb->buf to r->header_in.

Browse Source 
Code to reuse of r->request_body->buf in upstream module assumes it's
dedicated buffer, hence after 1.3.9 (r4931) it might reuse r->header_in
if client_body_in_file_only was set, resulting in original request
corruption.  It is considered to be safer to always create a dedicated
buffer for rb->bufs to avoid such problems.
This commit is contained in:
Maxim Dounin 2013-03-14 12:30:26 +00:00
parent 545cfd1fd3
commit 4641497e9c
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/http/ngx_http_request_body.c
View File

@ -104,7 +104,20 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
{ {
/* the whole request body may be placed in r->header_in */ /* the whole request body may be placed in r->header_in */
rb->buf = r->header_in; b = ngx_calloc_buf(r->pool);
if (b == NULL) {
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
goto done;
}
b->temporary = 1;
b->start = r->header_in->pos;
b->pos = r->header_in->pos;
b->last = r->header_in->last;
b->end = r->header_in->end;
rb->buf = b;
r->read_event_handler = ngx_http_read_client_request_body_handler; r->read_event_handler = ngx_http_read_client_request_body_handler;
r->write_event_handler = ngx_http_request_empty_handler; r->write_event_handler = ngx_http_request_empty_handler;