[PATCH] Image filter: large image handling

[Maxim Dounin]

Hello!

On Wed, Aug 28, 2013 at 12:21:27AM +0800, lanshun zhou wrote:

> # HG changeset patch
> # User Lanshun Zhou <zls.sogou at gmail.com>
> # Date 1377620347 -28800
> # Node ID 4fae04f332b489c85cdc116e6138a618372d3691
> # Parent  d1403de4163100ec0c6c015e57f22384456870e3
> Image filter: large image handling.
> 
> If Content-Length header is not set, and the image size is larger than the
> buffer size, client will hang until a timeout occurs.
> 
> Now NGX_HTTP_UNSUPPORTED_MEDIA_TYPE is returned immediately.
> 
> diff -r d1403de41631 -r 4fae04f332b4
> src/http/modules/ngx_http_image_filter_module.c
> --- a/src/http/modules/ngx_http_image_filter_module.c   Tue Aug 27 17:37:15
> 2013 +0400
> +++ b/src/http/modules/ngx_http_image_filter_module.c   Wed Aug 28 00:19:07
> 2013 +0800
> @@ -478,7 +478,14 @@
>                         "image buf: %uz", size);
> 
>          rest = ctx->image + ctx->length - p;
> -        size = (rest < size) ? rest : size;
> +        if (rest < size) {
> +            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
> +                          "image filter: too big response: >%z, "
> +                          "try to increase image_filter_buffer",
> +                          ctx->length);
> +
> +            return NGX_ERROR;
> +        }

Good catch, thnx.

I don't think the message should be different from one emitted with
Content-Length available though.  What about something like this:

--- a/src/http/modules/ngx_http_image_filter_module.c
+++ b/src/http/modules/ngx_http_image_filter_module.c
@@ -478,7 +478,12 @@ ngx_http_image_read(ngx_http_request_t
                        "image buf: %uz", size);
 
         rest = ctx->image + ctx->length - p;
-        size = (rest < size) ? rest : size;
+
+        if (size > rest) {
+            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                          "image filter: too big response");
+            return NGX_ERROR;
+        }
 
         p = ngx_cpymem(p, b->pos, size);
         b->pos += size;


?

-- 
Maxim Dounin
http://nginx.org/en/donation.html