]> git.kaiwu.me - nginx.git/commit
projects / nginx.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: de3c7a8) | patch
SPDY: fixed the DATA frame length handling in case of some errors.
authorValentin Bartenev <vbart@nginx.com>
Fri, 28 Mar 2014 16:05:07 +0000 (20:05 +0400)
committerValentin Bartenev <vbart@nginx.com>
Fri, 28 Mar 2014 16:05:07 +0000 (20:05 +0400)
commitafb92a8127d30e7c4ff6387a9b9761924b134940
tree02d1feaaef48dda559580d08ab4ac6b5ff129b26tree | snapshot
parentde3c7a825ee446fe4e0dc84df3d57bfebdf8c6f6commit | diff
SPDY: fixed the DATA frame length handling in case of some errors.

There are a few cases in ngx_http_spdy_state_read_data() related to error
handling when ngx_http_spdy_state_skip() might be called with an inconsistent
state between *pos and sc->length, that leads to violation of frame layout
parsing and resuted in corruption of spdy connection.

Based on a patch by Xiaochen Wang.
src/http/ngx_http_spdy.c diff | blob | history
nginx upstream