Fetch: fix Content-Length reservation in request building

Previously, the reservation passed to njs_chb_sprintf() was too
small for the maximum size_t output, so the header could be
silently truncated for very large request bodies.

diff --git a/nginx/ngx_js_http.c b/nginx/ngx_js_http.c
index bd8260a2c536a1a1258205e3922535c1c2415a3e..e5d367e9754d3d8fe33ba8efe724c1890bc9cf36 100644 (file)
--- a/nginx/ngx_js_http.c
+++ b/nginx/ngx_js_http.c
@@ -2263,8 +2263,10 @@ ngx_js_fetch_build_request(ngx_js_http_t *http, ngx_js_request_t *request,
     }
 
     if (request->body.len != 0) {
-        njs_chb_sprintf(&http->chain, 32, "Content-Length: %uz" CRLF CRLF,
-                        request->body.len);
+        njs_chb_sprintf(&http->chain,
+                        sizeof("Content-Length: " CRLF CRLF) - 1
+                        + NGX_SIZE_T_LEN,
+                        "Content-Length: %uz" CRLF CRLF, request->body.len);
         njs_chb_append(&http->chain, request->body.data, request->body.len);
 
     } else {