[PATCH] SPDY: fixed handling of sc->length in ngx_http_spdy_state_read_data()

[Valentin V. Bartenev]

On Wednesday 26 March 2014 12:30:11 Xiaochen Wang wrote:
> In our production, sometimes, the disk was full. In which case, the requests
> after the POST request were handled wrongly in one spdy connection.
> 
> Because the input body (DATA frame) of POST request could not be written to disk,
> then ngx_http_spdy_state_read_data() tried to skip this DATA frame with wrong
> sc->length, which broke spdy stream.
> 
> 
> # HG changeset patch
> # User Xiaochen Wang <wangxiaochen0 at gmail.com>
> # Date 1395807655 -28800
> # Node ID c18a0115c6027ad0ad475061d2984d90544d8449
> # Parent  bd91f286ee0ade98e9c0f8f55bfef54a122adaf2
> SPDY: fixed handling of sc->length in ngx_http_spdy_state_read_data()
> 
> diff -r bd91f286ee0a -r c18a0115c602 src/http/ngx_http_spdy.c
> --- a/src/http/ngx_http_spdy.c	Mon Mar 24 16:35:44 2014 -0700
> +++ b/src/http/ngx_http_spdy.c	Wed Mar 26 12:20:55 2014 +0800
> @@ -1519,7 +1519,6 @@
>          complete = 1;
>  
>      } else {
> -        sc->length -= size;
>          complete = 0;
>      }
>  
> @@ -1567,6 +1566,7 @@
>              buf->pos = pos;
>  
>              pos += size;
> +            sc->length -= size;
>  
>              buf->end = pos;
>              buf->last = pos;
> @@ -1585,6 +1585,7 @@
>          } else {
>              buf->last = ngx_cpymem(buf->last, pos, size);
>              pos += size;
> +            sc->length -= size;
>          }
>  
>          r->request_length += size;
> 

Thank you for the report.  I'd prefer a slightly smaller patch:

diff -r e45fa57ef725 src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c  Thu Mar 06 23:15:10 2014 +0400
+++ b/src/http/ngx_http_spdy.c  Wed Mar 26 10:55:33 2014 +0400
@@ -1496,7 +1496,6 @@ ngx_http_spdy_state_read_data(ngx_http_s
         complete = 1;
 
     } else {
-        sc->length -= size;
         complete = 0;
     }
 
@@ -1539,6 +1538,8 @@ ngx_http_spdy_state_read_data(ngx_http_s
             }
         }
 
+        sc->length -= size;
+
         if (tf) {
             buf->start = pos;
             buf->pos = pos;

--

 wbr, Valentin V. Bartenev