From: Valentin Bartenev <vbart@nginx.com>
Date: Wed, 26 Mar 2014 13:43:39 +0000 (+0400)
Subject: SPDY: detect premature end of frame while start parsing headers.
X-Git-Tag: release-1.5.13~21
X-Git-Url: http://www.kaiwu.me/postgresql/commit/static/gitweb.js?a=commitdiff_plain;h=042122a066c62cfe0748697d0f16b35fa96409c2;p=nginx.git

SPDY: detect premature end of frame while start parsing headers.
---

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index f6cf2ffba..3231b4673 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -1049,6 +1049,15 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos,
     if (r->headers_in.headers.part.elts == NULL) {
 
         if (buf->last - buf->pos < NGX_SPDY_NV_NUM_SIZE) {
+
+            if (complete) {
+                ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                              "client sent SYN_STREAM frame "
+                              "with invalid HEADERS block");
+                ngx_http_spdy_close_stream(sc->stream, NGX_HTTP_BAD_REQUEST);
+                return ngx_http_spdy_state_protocol_error(sc);
+            }
+
             return ngx_http_spdy_state_save(sc, pos, end,
                                             ngx_http_spdy_state_headers);
         }