[PATCH] SPDY: fixed handling of sc->length in ngx_http_spdy_state_read_data()

[Xiaochen Wang]

hi,

On Wed, Mar 26, 2014 at 3:02 PM, Valentin V. Bartenev <vbart at nginx.com>wrote:

> On Wednesday 26 March 2014 12:30:11 Xiaochen Wang wrote:
> > In our production, sometimes, the disk was full. In which case, the
> requests
> > after the POST request were handled wrongly in one spdy connection.
> >
> > Because the input body (DATA frame) of POST request could not be written
> to disk,
> > then ngx_http_spdy_state_read_data() tried to skip this DATA frame with
> wrong
> > sc->length, which broke spdy stream.
> >
> >
> > # HG changeset patch
> > # User Xiaochen Wang <wangxiaochen0 at gmail.com>
> > # Date 1395807655 -28800
> > # Node ID c18a0115c6027ad0ad475061d2984d90544d8449
> > # Parent  bd91f286ee0ade98e9c0f8f55bfef54a122adaf2
> > SPDY: fixed handling of sc->length in ngx_http_spdy_state_read_data()
> >
> > diff -r bd91f286ee0a -r c18a0115c602 src/http/ngx_http_spdy.c
> > --- a/src/http/ngx_http_spdy.c        Mon Mar 24 16:35:44 2014 -0700
> > +++ b/src/http/ngx_http_spdy.c        Wed Mar 26 12:20:55 2014 +0800
> > @@ -1519,7 +1519,6 @@
> >          complete = 1;
> >
> >      } else {
> > -        sc->length -= size;
> >          complete = 0;
> >      }
> >
> > @@ -1567,6 +1566,7 @@
> >              buf->pos = pos;
> >
> >              pos += size;
> > +            sc->length -= size;
> >
> >              buf->end = pos;
> >              buf->last = pos;
> > @@ -1585,6 +1585,7 @@
> >          } else {
> >              buf->last = ngx_cpymem(buf->last, pos, size);
> >              pos += size;
> > +            sc->length -= size;
> >          }
> >
> >          r->request_length += size;
> >
>
> Thank you for the report.  I'd prefer a slightly smaller patch:
>
Agree.


>
> diff -r e45fa57ef725 src/http/ngx_http_spdy.c
> --- a/src/http/ngx_http_spdy.c  Thu Mar 06 23:15:10 2014 +0400
> +++ b/src/http/ngx_http_spdy.c  Wed Mar 26 10:55:33 2014 +0400
> @@ -1496,7 +1496,6 @@ ngx_http_spdy_state_read_data(ngx_http_s
>          complete = 1;
>
>      } else {
> -        sc->length -= size;
>          complete = 0;
>      }
>
> @@ -1539,6 +1538,8 @@ ngx_http_spdy_state_read_data(ngx_http_s
>              }
>          }
>
> +        sc->length -= size;
> +

         if (tf) {
>              buf->start = pos;
>              buf->pos = pos;
>
> --
>
>  wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx-devel mailing list
> nginx-devel at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>

Thanks,
Xiaochen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20140326/253adf36/attachment.html>