From: Valentin Bartenev <vbart@nginx.com>
Date: Fri, 13 Nov 2015 17:10:50 +0000 (+0300)
Subject: HTTP/2: fixed handling of output HEADERS frames.
X-Git-Tag: release-1.9.7~3
X-Git-Url: http://git.kaiwu.me/sitemap.xml?a=commitdiff_plain;h=548e31f6084e2a90d0befcb5c8ff549466a111d3;p=nginx.git

HTTP/2: fixed handling of output HEADERS frames.

The HEADERS frame is always represented by more than one buffer since
b930e598a199, but the handling code hasn't been adjusted.

Only the first buffer of HEADERS frame was checked and if it had been
sent while others had not, the rest of the frame was dropped, resulting
in broken connection.

Before b930e598a199, the problem could only be seen in case of HEADERS
frame with CONTINUATION.
---

diff --git a/src/http/v2/ngx_http_v2_filter_module.c b/src/http/v2/ngx_http_v2_filter_module.c
index a866cdef6..aea5933f0 100644
--- a/src/http/v2/ngx_http_v2_filter_module.c
+++ b/src/http/v2/ngx_http_v2_filter_module.c
@@ -1054,16 +1054,29 @@ static ngx_int_t
 ngx_http_v2_headers_frame_handler(ngx_http_v2_connection_t *h2c,
     ngx_http_v2_out_frame_t *frame)
 {
-    ngx_buf_t             *buf;
+    ngx_chain_t           *cl;
     ngx_http_v2_stream_t  *stream;
 
-    buf = frame->first->buf;
+    stream = frame->stream;
+    cl = frame->first;
 
-    if (buf->pos != buf->last) {
-        return NGX_AGAIN;
-    }
+    for ( ;; ) {
+        if (cl->buf->pos != cl->buf->last) {
+            frame->first = cl;
 
-    stream = frame->stream;
+            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
+                           "http2:%ui HEADERS frame %p was sent partially",
+                           stream->node->id, frame);
+
+            return NGX_AGAIN;
+        }
+
+        if (cl == frame->last) {
+            break;
+        }
+
+        cl = cl->next;
+    }
 
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
                    "http2:%ui HEADERS frame %p was sent",