Problem with request body and client_body_in_single_buffer

[Maxim Dounin]

Hello!

On Fri, Jul 01, 2011 at 01:48:11AM +0200, Hendrik Schumacher wrote:

> I just had a hard time tracking down the following issue:
> 
> I have an apache with mod_perl running behind nginx 0.8.54. In my mod_perl
> application decoding large file uploads in multipart/form-data failed. It
> seems that the beginning of the request body was repeated (resulting in
> one small truncated file and one large corrupt file with no ending
> boundary). After deep-debugging my application I disabled nginx and the
> upload worked again. So I inspected the nginx settings and commenting out
> the following line makes my problem go away:
> 
> client_body_in_single_buffer on;
> 
> Could it be that nginx somehow doubles the beginning of the request body
> if it detects that the client body does not fit in a buffer?

Yes, thank you for report.  Attached patch (for 1.0.4, but will 
apply to 0.8.54 as well) fixes this problem.

Maxim Dounin
-------------- next part --------------
# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1309799136 -14400
# Node ID 99e276bba8596bc4df9e638482ee413f4c6bf700
# Parent  e7b2f945d55ae44a2295facf9e3336dc4633e5b5
Core: fix body with request_body_in_single_buf.

If there were preread data and request body was big enough first part
of request body was duplicated.

See report here:
http://nginx.org/pipermail/nginx/2011-July/027756.html

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -372,7 +372,9 @@ ngx_http_do_read_client_request_body(ngx
         }
     }
 
-    if (r->request_body_in_file_only && rb->bufs->next) {
+    if (rb->bufs->next
+        && (r->request_body_in_file_only || r->request_body_in_single_buf))
+    {
         rb->bufs = rb->bufs->next;
     }