about summary refs log tree commit homepage
path: root/lib
diff options
context:
space:
mode:
authorEric Wong <normalperson@yhbt.net>2009-11-04 23:02:02 -0800
committerEric Wong <normalperson@yhbt.net>2009-11-04 23:02:02 -0800
commit0ab37e1f493c792e7c21086116adff1a63bf3ff8 (patch)
treeed656d243543faa8d6e8fcfca3f896f49cbbd307 /lib
parenta45c6246933f7eb05fafbfcdc233a42e64947acb (diff)
downloadunicorn-0ab37e1f493c792e7c21086116adff1a63bf3ff8.tar.gz
Found in Rainbows! testing.  Reusing the buffer when finalizing
input for headers could be problematic because it would lead
to the @buf2 instance variable being clobbered; allowing the
trailers to "leak" into the body.
Diffstat (limited to 'lib')
-rw-r--r--lib/unicorn/tee_input.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/unicorn/tee_input.rb b/lib/unicorn/tee_input.rb
index 7e77cdf..b66dce0 100644
--- a/lib/unicorn/tee_input.rb
+++ b/lib/unicorn/tee_input.rb
@@ -142,7 +142,7 @@ module Unicorn
 
     def finalize_input
       while parser.trailers(req, buf).nil?
-        buf << socket.readpartial(Const::CHUNK_SIZE, @buf2)
+        buf << socket.readpartial(Const::CHUNK_SIZE)
       end
       self.socket = nil
     end