]> git.ipfire.org Git - thirdparty/curl.git/commit
http2: Copy data passed in Curl_http2_switched into HTTP/2 connection buffer
authorTatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Mon, 25 May 2015 15:10:05 +0000 (00:10 +0900)
committerDaniel Stenberg <daniel@haxx.se>
Mon, 25 May 2015 21:07:49 +0000 (23:07 +0200)
commit02dfc930b5d5aaeab0ea7bf0019d2e753daa7491
treec48c7d25b16f24c51440f86ef53a50c0d15a75d1
parent96c0164b8871d36eeaafdfc99b1a9bea2b83657e
http2: Copy data passed in Curl_http2_switched into HTTP/2 connection buffer

Previously, after seeing upgrade to HTTP/2, we feed data followed by
upgrade response headers directly to nghttp2_session_mem_recv() in
Curl_http2_switched().  But it turns out that passed buffer, mem, is
part of stream->mem, and callbacks called by
nghttp2_session_mem_recv() will write stream specific data into
stream->mem, overwriting input data.  This will corrupt input, and
most likely frame length error is detected by nghttp2 library.  The
fix is first copy the passed data to HTTP/2 connection buffer,
httpc->inbuf, and call nghttp2_session_mem_recv().
lib/http2.c