Fixed lingering_time check.

There are two significant changes in this patch:

1) The <= 0 comparison is done with a signed type.  This fixes the case
   of ngx_time() being larger than r->lingering_time.

2) Calculation of r->lingering_time - ngx_time() is now always done
   in the ngx_msec_t type.  This ensures the calculation is correct
   even if time_t is unsigned and differs in size from ngx_msec_t.

Thanks to Lanshun Zhou.

2 files changed, 4 insertions, 4 deletions

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index c8c5d153f..64f31b2c3 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -3166,8 +3166,8 @@ ngx_http_lingering_close_handler(ngx_event_t *rev)
         return;
     }
 
-    timer = (ngx_msec_t) (r->lingering_time - ngx_time());
-    if (timer <= 0) {
+    timer = (ngx_msec_t) r->lingering_time - (ngx_msec_t) ngx_time();
+    if ((ngx_msec_int_t) timer <= 0) {
         ngx_http_close_request(r, 0);
         return;
     }
diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index 7ca328791..fc3a1800d 100644
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -570,9 +570,9 @@ ngx_http_discarded_request_body_handler(ngx_http_request_t *r)
     }
 
     if (r->lingering_time) {
-        timer = (ngx_msec_t) (r->lingering_time - ngx_time());
+        timer = (ngx_msec_t) r->lingering_time - (ngx_msec_t) ngx_time();
 
-        if (timer <= 0) {
+        if ((ngx_msec_int_t) timer <= 0) {
             r->discard_body = 0;
             r->lingering_close = 0;
             ngx_http_finalize_request(r, NGX_ERROR);