[nginx] svn commit: r4937 - trunk/src/http

[mdounin at mdounin.ru]

Author: mdounin
Date: 2012-11-26 18:01:08 +0000 (Mon, 26 Nov 2012)
New Revision: 4937
URL: http://trac.nginx.org/nginx/changeset/4937/nginx

Log:
Request body: error checking fixes, negative rb->rest handling.

Negative rb->rest can't happen with current code, but it's good to have
it handled anyway.

Found by Coverity (CID 744846, 744847, 744848).


Modified:
   trunk/src/http/ngx_http_request_body.c

Modified: trunk/src/http/ngx_http_request_body.c
===================================================================
--- trunk/src/http/ngx_http_request_body.c	2012-11-26 18:00:14 UTC (rev 4936)
+++ trunk/src/http/ngx_http_request_body.c	2012-11-26 18:01:08 UTC (rev 4937)
@@ -134,6 +134,13 @@
         return NGX_OK;
     }
 
+    if (rb->rest < 0) {
+        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
+                      "negative request body rest");
+        rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
+        goto done;
+    }
+
     clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
 
     size = clcf->client_body_buffer_size;
@@ -643,7 +650,7 @@
             }
 
             rb->chunked = ngx_pcalloc(r->pool, sizeof(ngx_http_chunked_t));
-            if (rb == NULL) {
+            if (rb->chunked == NULL) {
                 return NGX_HTTP_INTERNAL_SERVER_ERROR;
             }
 
@@ -1022,7 +1029,9 @@
 
     /* TODO: coalesce neighbouring buffers */
 
-    ngx_chain_add_copy(r->pool, &rb->bufs, in);
+    if (ngx_chain_add_copy(r->pool, &rb->bufs, in) != NGX_OK) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
 
     return NGX_OK;
 }