bugfix: ngx.req.raw_header(): buffer overflow and the "buffer error" exception might happen for massively pipelined downstream requests. thanks Dane Knecht for the report.

src/ngx_http_lua_headers.c

@@ -154,6 +154,7 @@ ngx_http_lua_ngx_req_raw_header(lua_State *L)
                 first = b;
             }
 
+            dd("adding size %d", (int) (b->pos - b->start));
             size += b->pos - b->start;
         }
     }
@@ -167,7 +168,10 @@ ngx_http_lua_ngx_req_raw_header(lua_State *L)
     last = data;
 
     b = c->buffer;
+    found = 0;
+
     if (first == b) {
+        found = 1;
         pos = b->pos;
 
         if (no_req_line) {
@@ -207,7 +211,6 @@ ngx_http_lua_ngx_req_raw_header(lua_State *L)
     }
 
     if (hc->nbusy) {
-        found = (b == c->buffer);
         for (i = 0; i < hc->nbusy; i++) {
             b = hc->busy[i];
 

t/104-req-raw-header.t

@@ -9,10 +9,10 @@ use Test::Nginx::Socket::Lua;
 
 repeat_each(2);
 
-plan tests => repeat_each() * (blocks() * 3 + 6);
+plan tests => repeat_each() * (blocks() * 3 + 15);
 
 #no_diff();
-#no_long_string();
+no_long_string();
 run_tests();
 
 __DATA__
@@ -776,3 +776,105 @@ Content-Length: 5
 --- no_error_log
 [error]
 
+
+
+=== TEST 27: two pipelined requests with large headers
+--- config
+    client_header_buffer_size 10;
+    large_client_header_buffers 3 5610;
+    location /t {
+        content_by_lua '
+            ngx.print(ngx.req.raw_header())
+        ';
+    }
+--- pipelined_requests eval
+["GET /t", "GET /t"]
+--- more_headers eval
+CORE::join "\n", map { "Header$_: value-$_" } 1..585
+
+--- response_body eval
+[qq{GET /t HTTP/1.1\r
+Host: localhost\r
+Connection: keep-alive\r
+}
+.(CORE::join "\r\n", map { "Header$_: value-$_" } 1..585) . "\r\n\r\n",
+qq{GET /t HTTP/1.1\r
+Host: localhost\r
+Connection: close\r
+}
+.(CORE::join "\r\n", map { "Header$_: value-$_" } 1..585) . "\r\n\r\n",
+,
+]
+
+--- no_error_log
+[error]
+--- timeout: 5
+
+
+
+=== TEST 28: a request with large header and a smaller pipelined request following
+--- config
+    client_header_buffer_size 10;
+    large_client_header_buffers 2 1921;
+    location /t {
+        content_by_lua '
+            ngx.print(ngx.req.raw_header())
+        ';
+    }
+--- pipelined_requests eval
+["GET /t", "GET /t"]
+--- more_headers eval
+[CORE::join("\n", map { "Header$_: value-$_" } 1..170), "Foo: bar\n"]
+
+--- response_body eval
+[qq{GET /t HTTP/1.1\r
+Host: localhost\r
+Connection: keep-alive\r
+}
+.(CORE::join "\r\n", map { "Header$_: value-$_" } 1..170) . "\r\n\r\n",
+qq{GET /t HTTP/1.1\r
+Host: localhost\r
+Connection: close\r
+Foo: bar\r
+\r
+},
+]
+
+--- no_error_log
+[error]
+--- timeout: 5
+
+
+
+=== TEST 29: a request with large header and a smaller pipelined request following
+--- config
+    client_header_buffer_size 10;
+    large_client_header_buffers 2 1921;
+    location /t {
+        content_by_lua '
+            ngx.print(ngx.req.raw_header())
+        ';
+    }
+--- pipelined_requests eval
+["GET /t", "GET /t" . ("a" x 512)]
+--- more_headers eval
+[CORE::join("\n", map { "Header$_: value-$_" } 1..170), "Foo: bar\n"]
+
+--- response_body eval
+[qq{GET /t HTTP/1.1\r
+Host: localhost\r
+Connection: keep-alive\r
+}
+.(CORE::join "\r\n", map { "Header$_: value-$_" } 1..170) . "\r\n\r\n",
+qq{GET /t} . ("a" x 512) . qq{ HTTP/1.1\r
+Host: localhost\r
+Connection: close\r
+Foo: bar\r
+\r
+},
+]
+
+--- no_error_log
+[error]
+--- timeout: 5
+