Request body: fixed socket leak on errors.

The r->main->count reference counter was always incremented in
ngx_http_read_client_request_body(), while it is only needs to be
incremented on positive returns.

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index cb92fd184c13b43f531ccfd96611f953747eb36a..691f10e848dcff1a09103a00c5f75c4bcb37a0e5 100644 (file)
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -31,6 +31,7 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 {
     size_t                     preread;
     ssize_t                    size;
+    ngx_int_t                  rc;
     ngx_buf_t                 *b;
     ngx_chain_t               *cl, **next;
     ngx_http_request_body_t   *rb;
@@ -44,12 +45,14 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
     }
 
     if (ngx_http_test_expect(r) != NGX_OK) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        goto done;
     }
 
     rb = ngx_pcalloc(r->pool, sizeof(ngx_http_request_body_t));
     if (rb == NULL) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        goto done;
     }
 
     r->request_body = rb;
@@ -65,7 +68,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
         if (r->request_body_in_file_only) {
             if (ngx_http_write_request_body(r, NULL) != NGX_OK) {
-                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+                rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+                goto done;
             }
         }
 
@@ -95,7 +99,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
         b = ngx_calloc_buf(r->pool);
         if (b == NULL) {
-            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+            goto done;
         }
 
         b->temporary = 1;
@@ -106,7 +111,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
         rb->bufs = ngx_alloc_chain_link(r->pool);
         if (rb->bufs == NULL) {
-            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+            goto done;
         }
 
         rb->bufs->buf = b;
@@ -124,7 +130,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
             if (r->request_body_in_file_only) {
                 if (ngx_http_write_request_body(r, rb->bufs) != NGX_OK) {
-                    return NGX_HTTP_INTERNAL_SERVER_ERROR;
+                    rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+                    goto done;
                 }
             }
 
@@ -151,7 +158,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
             r->read_event_handler = ngx_http_read_client_request_body_handler;
 
-            return ngx_http_do_read_client_request_body(r);
+            rc = ngx_http_do_read_client_request_body(r);
+            goto done;
         }
 
         next = &rb->bufs->next;
@@ -181,12 +189,14 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
     rb->buf = ngx_create_temp_buf(r->pool, size);
     if (rb->buf == NULL) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        goto done;
     }
 
     cl = ngx_alloc_chain_link(r->pool);
     if (cl == NULL) {
-        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        goto done;
     }
 
     cl->buf = rb->buf;
@@ -211,7 +221,15 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
 
     r->read_event_handler = ngx_http_read_client_request_body_handler;
 
-    return ngx_http_do_read_client_request_body(r);
+    rc = ngx_http_do_read_client_request_body(r);
+
+done:
+
+    if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
+        r->main->count--;
+    }
+
+    return rc;
 }