From a4b482207d442359746b658b522975dc82e455b2 Mon Sep 17 00:00:00 2001 From: Sourav Bhowmik Date: Tue, 4 Aug 2026 06:34:19 -0700 Subject: [PATCH] Request body: flood detection for chunked request body Chunk sizes (including leading zeros), chunk extensions and trailers of a chunked request body were not accounted, allowing a client to send an unbounded amount of framing with little or no body data. Now all received bytes are counted in rb->received and compared to the body data, using the same flood detection as in HTTP/2 and HTTP/3. Reported by jskoetsier. --- src/http/ngx_http_request_body.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c index 1d8e4081a..d9d0c22e3 100644 --- a/src/http/ngx_http_request_body.c +++ b/src/http/ngx_http_request_body.c @@ -1090,6 +1090,7 @@ static ngx_int_t ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in) { size_t size; + u_char *p; ngx_int_t rc; ngx_buf_t *b; ngx_chain_t *cl, *out, *tl, **ll; @@ -1121,6 +1122,7 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in) for (cl = in; cl; cl = cl->next) { b = NULL; + p = cl->buf->pos; for ( ;; ) { @@ -1259,6 +1261,18 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in) return NGX_HTTP_BAD_REQUEST; } + + rb->received += cl->buf->pos - p; + + if (rb->received / 8 > r->headers_in.content_length_n + 1048576) { + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, + "client sent too large chunked body " + "overhead: %O+%O bytes", + r->headers_in.content_length_n, + rb->received - r->headers_in.content_length_n); + + return NGX_HTTP_BAD_REQUEST; + } } rc = ngx_http_top_request_body_filter(r, out); -- 2.47.3