]> git.kaiwu.me - nginx.git/commitdiff
Control API: fixed handling of oversized requests
author최대우 (Daewoo Choi) <daewoo.choi@hanwha.com>
Mon, 2 Nov 2026 04:07:30 +0000 (13:07 +0900)
committerAva Hahn <110854134+avahahn@users.noreply.github.com>
Wed, 4 Nov 2026 16:16:34 +0000 (08:16 -0800)
A request line larger than the receive buffer was answered with no
response at all, while every other malformed request gets a status
code.  The buffer-full check also ran at the start of the next read
event, which may never arrive, since SIGIO is raised by new data.
The check is now made after parsing, so 400 is returned right away.

src/os/unix/ngx_control.c

index 2877b6a65b02507619be756a460e377f2d351762..bfe5089487b63e646d80d7f5c194e714e4c01575 100644 (file)
@@ -567,12 +567,6 @@ ngx_control_handle_read(ngx_control_request_t *r)
 
     b = r->in;
 
-    if (b->last == b->end) {
-        ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0,
-                      "control: request too large");
-        return NGX_ERROR;
-    }
-
     n = recv(r->fd, b->last, b->end - b->last, 0);
 
     if (n < 0) {
@@ -594,6 +588,13 @@ ngx_control_handle_read(ngx_control_request_t *r)
     switch (ngx_control_parse_request_line(r)) {
 
     case NGX_AGAIN:
+        if (b->last == b->end) {
+            ngx_log_error(NGX_LOG_ERR, ngx_cycle->log, 0,
+                          "control: request too large");
+            ngx_control_pollfd[r->index].events &= ~POLLIN;
+            return ngx_control_send_response(r, NGX_CTRL_BAD_REQUEST, NULL);
+        }
+
         return NGX_AGAIN;
 
     case NGX_DECLINED: