[nginx] Detect runaway chunks in ngx_http_parse_chunked().

[Sergey Kandaurov]

details:   https://hg.nginx.org/nginx/rev/52b5ee64fe11
branches:  
changeset: 7562:52b5ee64fe11
user:      Sergey Kandaurov <pluknet at nginx.com>
date:      Tue Sep 03 17:26:56 2019 +0300
description:
Detect runaway chunks in ngx_http_parse_chunked().

As defined in HTTP/1.1, body chunks have the following ABNF:

   chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF

where chunk-data is a sequence of chunk-size octets.

With this change, chunk-data that doesn't end up with CRLF at chunk-size
offset will be treated as invalid, such as in the example provided below:

4
SEE-THIS-AND-
4
THAT
0

diffstat:

 src/http/ngx_http_parse.c |  3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diffs (13 lines):

diff -r 9f1f9d6e056a -r 52b5ee64fe11 src/http/ngx_http_parse.c
--- a/src/http/ngx_http_parse.c	Mon Aug 19 15:16:06 2019 +0300
+++ b/src/http/ngx_http_parse.c	Tue Sep 03 17:26:56 2019 +0300
@@ -2268,6 +2268,9 @@ ngx_http_parse_chunked(ngx_http_request_
                 break;
             case LF:
                 state = sw_chunk_start;
+                break;
+            default:
+                goto invalid;
             }
             break;