fix segfault when zero length file is PUT

1 files changed, 38 insertions, 3 deletions

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index 04347c2ce..727a4178b 100644
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -34,6 +34,7 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
     ssize_t                    size;
     ngx_buf_t                 *b;
     ngx_chain_t               *cl, **next;
+    ngx_temp_file_t           *tf;
     ngx_http_request_body_t   *rb;
     ngx_http_core_loc_conf_t  *clcf;
 
@@ -49,7 +50,43 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
     r->request_body = rb;
 
-    if (r->headers_in.content_length_n <= 0) {
+    if (r->headers_in.content_length_n < 0) {
+        post_handler(r);
+        return NGX_OK;
+    }
+
+    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
+
+    if (r->headers_in.content_length_n == 0) {
+
+        if (r->request_body_in_file_only) {
+            tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));
+            if (tf == NULL) {
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            }
+
+            tf->file.fd = NGX_INVALID_FILE;
+            tf->file.log = r->connection->log;
+            tf->path = clcf->client_body_temp_path;
+            tf->pool = r->pool;
+            tf->warn = "a client request body is buffered to a temporary file";
+            tf->log_level = r->request_body_file_log_level;
+            tf->persistent = r->request_body_in_persistent_file;
+
+            if (r->request_body_file_group_access) {
+                tf->mode = 0660;
+            }
+
+            rb->temp_file = tf;
+
+            if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,
+                                     tf->persistent, tf->mode)
+                != NGX_OK)
+            {
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            }
+        }
+
         post_handler(r);
         return NGX_OK;
     }
@@ -139,8 +176,6 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
         next = &rb->bufs;
     }
 
-    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
-
     size = clcf->client_body_buffer_size;
     size += size >> 2;