SPDY: better detect if headers block has wrong entries count.

Previously, only one case was checked: if there's more data to parse
in a r->header_in buffer, but the buffer can be filled to the end by
the last parsed entry, so we also need to check that there's no more
data to inflate.

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index 3231b4673a8d12bedd05ef33674f5b8c4b3e93f1..9c80febaf10c1479edae80ffc47506b83dbefc36 100644 (file)
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -1196,10 +1196,10 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
         }
     }
 
-    if (buf->pos != buf->last) {
-        /* TODO: improve error message */
-        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                       "end %ui %p %p", complete, buf->pos, buf->last);
+    if (buf->pos != buf->last || sc->zstream_in.avail_in) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent SYN_STREAM frame "
+                      "with invalid HEADERS block");
         ngx_http_spdy_close_stream(sc->stream, NGX_HTTP_BAD_REQUEST);
         return ngx_http_spdy_state_protocol_error(sc);
     }