aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/http/ngx_http_spdy.c18
1 files changed, 16 insertions, 2 deletions
diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index f8136213a..d72bc3f7c 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -809,6 +809,8 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
sc->zstream_in.next_in = pos;
sc->zstream_in.avail_in = size;
sc->zstream_in.next_out = buf->last;
+
+ /* one byte is reserved for null-termination of the last header value */
sc->zstream_in.avail_out = buf->end - buf->last - 1;
z = inflate(&sc->zstream_in, Z_NO_FLUSH);
@@ -912,9 +914,14 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
return ngx_http_spdy_state_headers_error(sc, pos, end);
}
+ /* null-terminate the last processed header name or value */
+ *buf->pos = '\0';
+
buf = r->header_in;
sc->zstream_in.next_out = buf->last;
+
+ /* one byte is reserved for null-termination */
sc->zstream_in.avail_out = buf->end - buf->last - 1;
z = inflate(&sc->zstream_in, Z_NO_FLUSH);
@@ -996,6 +1003,9 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
ngx_http_spdy_state_headers);
}
+ /* null-terminate the last header value */
+ *buf->pos = '\0';
+
ngx_http_spdy_run_request(r);
return ngx_http_spdy_state_complete(sc, pos, end);
@@ -1936,6 +1946,9 @@ ngx_http_spdy_parse_header(ngx_http_request_t *r)
return NGX_HTTP_PARSE_INVALID_HEADER;
}
+ /* null-terminate the previous header value */
+ *p = '\0';
+
p += NGX_SPDY_NV_NLEN_SIZE;
r->header_name_end = p + len;
@@ -2005,6 +2018,9 @@ ngx_http_spdy_parse_header(ngx_http_request_t *r)
return NGX_ERROR;
}
+ /* null-terminate header name */
+ *p = '\0';
+
p += NGX_SPDY_NV_VLEN_SIZE;
r->header_end = p + len;
@@ -2163,11 +2179,9 @@ ngx_http_spdy_handle_request_header(ngx_http_request_t *r)
h->key.len = r->lowcase_index;
h->key.data = r->header_name_start;
- h->key.data[h->key.len] = '\0';
h->value.len = r->header_size;
h->value.data = r->header_start;
- h->value.data[h->value.len] = '\0';
h->lowcase_key = h->key.data;