The official NGINX Open Source repository.
Go to file
Sergey Kandaurov 77c01f10a1 Detect runaway chunks in ngx_http_parse_chunked().
As defined in HTTP/1.1, body chunks have the following ABNF:

   chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF

where chunk-data is a sequence of chunk-size octets.

With this change, chunk-data that doesn't end up with CRLF at chunk-size
offset will be treated as invalid, such as in the example provided below:

4
SEE-THIS-AND-
4
THAT
0
2019-09-03 17:26:56 +03:00
auto Unconditional compilation of the postpone filter. 2019-05-08 19:22:13 +03:00
conf MIME: added font/woff2 type (ticket #1243). 2018-06-15 17:29:55 +03:00
contrib Contrib: vim syntax, update core and 3rd party module directives. 2019-06-30 10:39:01 +03:00
docs nginx-1.17.3-RELEASE 2019-08-13 15:45:56 +03:00
misc Updated OpenSSL used for win32 builds. 2019-06-25 04:47:43 +03:00
src Detect runaway chunks in ngx_http_parse_chunked(). 2019-09-03 17:26:56 +03:00
.hgtags release-1.17.3 tag 2019-08-13 15:45:57 +03:00