mirror of https://github.com/nginx/nginx.git
b19bc2e0fa
As part of normal HTTP/2 processing, incomplete frames are saved in the control state using a fixed size memcpy of NGX_HTTP_V2_STATE_BUFFER_SIZE. For this matter, two state buffers are reserved in the HTTP/2 recv buffer. As part of HTTP/2 auto-detection on plain TCP connections, initial data is first read into a buffer specified by the client_header_buffer_size directive that doesn't have state reservation. Previously, this made it possible to over-read the buffer as part of saving the state. The fix is to read the available buffer size rather than a fixed size. Although memcpy of a fixed size can produce a better optimized code, handling of incomplete frames isn't a common execution path, so it was sacrificed for the sake of simplicity of the fix. |
||
|---|---|---|
| .. | ||
| ngx_http_v2.c | ||
| ngx_http_v2.h | ||
| ngx_http_v2_encode.c | ||
| ngx_http_v2_filter_module.c | ||
| ngx_http_v2_module.c | ||
| ngx_http_v2_module.h | ||
| ngx_http_v2_table.c | ||