Fijxu
/
nginx-quic
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SPDY: elimination of r->blocked counter usage for queuing frames. 

It was used to prevent destroying of request object when there are unsent
frames in queue for the stream.  Since it was incremented for each frame
and is only 8 bits long, so it was not very hard to overflow the counter.

Now the stream->queued counter is checked instead.
This commit is contained in:
Valentin Bartenev 2014-01-14 16:24:45 +04:00
parent c53be33474
commit db5af0e702
2 changed files with 10 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/http/ngx_http_spdy.c
View File

@ -2642,9 +2642,16 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
sc = stream->connection;
ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
"spdy close stream %ui, processing %ui",
stream->id, sc->processing);
ngx_log_debug3(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
"spdy close stream %ui, queued %ui, processing %ui",
stream->id, stream->queued, sc->processing);
fc = stream->request->connection;
if (stream->queued) {
fc->write->handler = ngx_http_spdy_close_stream_handler;
return;
}
if (!stream->out_closed) {
if (ngx_http_spdy_send_rst_stream(sc, stream->id,
@ -2685,8 +2692,6 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
index = &s->index;
}
fc = stream->request->connection;
ngx_http_free_request(stream->request, rc);
ev = fc->read;
@ -2862,7 +2867,6 @@ ngx_http_spdy_finalize_connection(ngx_http_spdy_connection_t *sc,
fc->error = 1;
if (stream->queued) {
r->blocked -= stream->queued;
stream->queued = 0;
ev = fc->write;

10
src/http/ngx_http_spdy_filter_module.c
View File

@ -597,8 +597,6 @@ ngx_http_spdy_header_filter(ngx_http_request_t *r)
ngx_http_spdy_queue_blocked_frame(sc, frame);
r->blocked++;
cln = ngx_http_cleanup_add(r, 0);
if (cln == NULL) {
return NGX_ERROR;
@ -697,8 +695,6 @@ ngx_http_spdy_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
stream->queued++;
r->main->blocked++;
return ngx_http_spdy_filter_send(r->connection, stream);
}
@ -923,7 +919,6 @@ ngx_http_spdy_handle_frame(ngx_http_spdy_stream_t *stream,
r = stream->request;
r->connection->sent += frame->size;
r->blocked--;
if (frame->fin) {
stream->out_closed = 1;
@ -962,15 +957,12 @@ ngx_http_spdy_filter_cleanup(void *data)
{
ngx_http_spdy_stream_t *stream = data;
ngx_http_request_t *r;
ngx_http_spdy_out_frame_t *frame, **fn;
if (stream->queued == 0) {
return;
}
r = stream->request;
fn = &stream->connection->last_out;
for ( ;; ) {
@ -981,9 +973,7 @@ ngx_http_spdy_filter_cleanup(void *data)
}
if (frame->stream == stream && !frame->blocked) {
stream->queued--;
r->blocked--;
*fn = frame->next;
continue;