Skip to content

Commit

Permalink
HTTP/2: fixed socket leak with an incomplete HEADERS frame.
Browse files Browse the repository at this point in the history
A connection could get stuck without timers if a client has partially sent
the HEADERS frame such that it was split on the individual header boundary.
In this case, it cannot be processed without the rest of the HEADERS frame.

The fix is to call ngx_http_v2_state_headers_save() in this case.  Normally,
it would be called from the ngx_http_v2_state_header_block() handler on the
next iteration, when there is not enough data to continue processing.  This
isn't the case if recv_buffer became empty and there's no more data to read.
  • Loading branch information
pluknet committed Feb 5, 2020
1 parent b7ea950 commit 16168dc
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions src/http/v2/ngx_http_v2.c
Original file line number Diff line number Diff line change
Expand Up @@ -1719,8 +1719,13 @@ ngx_http_v2_state_header_complete(ngx_http_v2_connection_t *h2c, u_char *pos,
ngx_http_v2_stream_t *stream;

if (h2c->state.length) {
h2c->state.handler = ngx_http_v2_state_header_block;
return pos;
if (end - pos > 0) {
h2c->state.handler = ngx_http_v2_state_header_block;
return pos;
}

return ngx_http_v2_state_headers_save(h2c, pos, end,
ngx_http_v2_state_header_block);
}

if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)) {
Expand Down

0 comments on commit 16168dc

Please sign in to comment.