1berry/nginx
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HTTP/2: fixed buffer management with HTTP/2 auto-detection.

Browse Source 
As part of normal HTTP/2 processing, incomplete frames are saved in the
control state using a fixed size memcpy of NGX_HTTP_V2_STATE_BUFFER_SIZE.
For this matter, two state buffers are reserved in the HTTP/2 recv buffer.

As part of HTTP/2 auto-detection on plain TCP connections, initial data
is first read into a buffer specified by the client_header_buffer_size
directive that doesn't have state reservation.  Previously, this made it
possible to over-read the buffer as part of saving the state.

The fix is to read the available buffer size rather than a fixed size.
Although memcpy of a fixed size can produce a better optimized code,
handling of incomplete frames isn't a common execution path, so it was
sacrificed for the sake of simplicity of the fix.
This commit is contained in:
Sergey Kandaurov 2023-10-21 18:48:24 +04:00
parent 31620d1a89
commit b19bc2e0fa
2 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/http/v2/ngx_http_v2.c
View File

@ -386,13 +386,11 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
h2mcf = ngx_http_get_module_main_conf(h2c->http_connection->conf_ctx, h2mcf = ngx_http_get_module_main_conf(h2c->http_connection->conf_ctx,
ngx_http_v2_module); ngx_http_v2_module);
available = h2mcf->recv_buffer_size - 2 * NGX_HTTP_V2_STATE_BUFFER_SIZE; available = h2mcf->recv_buffer_size - NGX_HTTP_V2_STATE_BUFFER_SIZE;
do { do {
p = h2mcf->recv_buffer; p = h2mcf->recv_buffer;
end = ngx_cpymem(p, h2c->state.buffer, h2c->state.buffer_used);
ngx_memcpy(p, h2c->state.buffer, NGX_HTTP_V2_STATE_BUFFER_SIZE);
end = p + h2c->state.buffer_used;
n = c->recv(c, end, available); n = c->recv(c, end, available);
@ -2592,7 +2590,7 @@ ngx_http_v2_state_save(ngx_http_v2_connection_t *h2c, u_char *pos, u_char *end,
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
} }
ngx_memcpy(h2c->state.buffer, pos, NGX_HTTP_V2_STATE_BUFFER_SIZE); ngx_memcpy(h2c->state.buffer, pos, size);
h2c->state.buffer_used = size; h2c->state.buffer_used = size;
h2c->state.handler = handler; h2c->state.handler = handler;

2
src/http/v2/ngx_http_v2_module.c
View File

@ -388,7 +388,7 @@ ngx_http_v2_recv_buffer_size(ngx_conf_t *cf, void *post, void *data)
{ {
size_t *sp = data; size_t *sp = data;
if (*sp <= 2 * NGX_HTTP_V2_STATE_BUFFER_SIZE) { if (*sp <= NGX_HTTP_V2_STATE_BUFFER_SIZE) {
return "value is too small"; return "value is too small";
} }