mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-04 22:09:01 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

SPDY: fixed the DATA frame length handling in case of some errors.

Browse Source 
There are a few cases in ngx_http_spdy_state_read_data() related to error
handling when ngx_http_spdy_state_skip() might be called with an inconsistent
state between *pos and sc->length, that leads to violation of frame layout
parsing and resuted in corruption of spdy connection.

Based on a patch by Xiaochen Wang.
This commit is contained in:
Valentin Bartenev 2014-03-28 20:05:07 +04:00
parent de3c7a825e
commit afb92a8127
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/http/ngx_http_spdy.c
View File

@ -1528,7 +1528,6 @@ ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc, u_char *pos,
complete = 1; complete = 1;
} else { } else {
sc->length -= size;
complete = 0; complete = 0;
} }
@ -1571,6 +1570,8 @@ ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc, u_char *pos,
} }
} }
sc->length -= size;
if (tf) { if (tf) {
buf->start = pos; buf->start = pos;
buf->pos = pos; buf->pos = pos;