Changes with nginx 0.5.34 13 Dec 2007v0.5.34

    *) Change: now the full request line instead of URI only is written to
       error_log.

    *) Feature: Cygwin compatibility.
       Thanks to Vladimir Kutakov.

    *) Feature: the "merge_slashes" directive.

    *) Feature: the "gzip_vary" directive.

    *) Feature: the "server_tokens" directive.

    *) Feature: the "access_log" directive may be used inside the
       "limit_except" block.

    *) Bugfix: if the $server_protocol was used in FastCGI parameters and a
       request line length was near to the "client_header_buffer_size"
       directive value, then nginx issued an alert "fastcgi: the request
       record is too big".

    *) Bugfix: if a plain text HTTP/0.9 version request was made to HTTPS
       server, then nginx returned usual response.

    *) Bugfix: URL double escaping in a redirect of the "msie_refresh"
       directive; bug appeared in 0.5.28.

    *) Bugfix: a segmentation fault might occur in worker process if
       subrequests were used.

    *) Bugfix: the big responses may be transferred truncated if SSL and
       gzip were used.

    *) Bugfix: compatibility with mget.

    *) Bugfix: nginx did not unescape URI in the "include" SSI command.

    *) Bugfix: the segmentation fault was occurred on start or while
       reconfiguration if variable was used in the "charset" or
       "source_charset" directives.

    *) Bugfix: nginx returned the 400 response on requests like
       "GET http://www.domain.com HTTP/1.0".
       Thanks to James Oakley.

    *) Bugfix: a segmentation fault occurred in worker process if
       $date_local and $date_gmt were used outside the
       ngx_http_ssi_filter_module.

    *) Bugfix: a segmentation fault might occur in worker process if debug
       log was enabled.
       Thanks to Andrei Nigmatulin.

    *) Bugfix: ngx_http_memcached_module did not set
       $upstream_response_time.
       Thanks to Maxim Dounin.

    *) Bugfix: a worker process may got caught in an endless loop, if the
       memcached was used.

1 files changed, 46 insertions, 4 deletions

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 559a5cbd5..66bd36eea 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -124,6 +124,7 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
         sw_major_digit,
         sw_first_minor_digit,
         sw_minor_digit,
+        sw_spaces_after_digit,
         sw_almost_done
     } state;
 
@@ -335,18 +336,26 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                 break;
             }
 
+            r->host_end = p;
+
             switch (ch) {
             case ':':
-                r->host_end = p;
                 state = sw_port;
                 break;
             case '/':
-                r->host_end = p;
                 r->uri_start = p;
                 state = sw_after_slash_in_uri;
                 break;
+            case ' ':
+                /*
+                 * use single "/" from request line to preserve pointers,
+                 * if request line will be copied to large client buffer
+                 */
+                r->uri_start = r->schema_end + 1;
+                r->uri_end = r->schema_end + 2;
+                state = sw_http_09;
+                break;
             default:
-                r->host_end = p;
                 return NGX_HTTP_PARSE_INVALID_REQUEST;
             }
             break;
@@ -362,6 +371,16 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                 r->uri_start = p;
                 state = sw_after_slash_in_uri;
                 break;
+            case ' ':
+                r->port_end = p;
+                /*
+                 * use single "/" from request line to preserve pointers,
+                 * if request line will be copied to large client buffer
+                 */
+                r->uri_start = r->schema_end + 1;
+                r->uri_end = r->schema_end + 2;
+                state = sw_http_09;
+                break;
             default:
                 return NGX_HTTP_PARSE_INVALID_REQUEST;
             }
@@ -618,6 +637,11 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
                 goto done;
             }
 
+            if (ch == ' ') {
+                state = sw_spaces_after_digit;
+                break;
+            }
+
             if (ch < '0' || ch > '9') {
                 return NGX_HTTP_PARSE_INVALID_REQUEST;
             }
@@ -625,6 +649,20 @@ ngx_http_parse_request_line(ngx_http_request_t *r, ngx_buf_t *b)
             r->http_minor = r->http_minor * 10 + ch - '0';
             break;
 
+        case sw_spaces_after_digit:
+            switch (ch) {
+            case ' ':
+                break;
+            case CR:
+                state = sw_almost_done;
+                break;
+            case LF:
+                goto done;
+            default:
+                return NGX_HTTP_PARSE_INVALID_REQUEST;
+            }
+            break;
+
         /* end of request line */
         case sw_almost_done:
             r->request_end = p - 1;
@@ -890,7 +928,7 @@ header_done:
 
 
 ngx_int_t
-ngx_http_parse_complex_uri(ngx_http_request_t *r)
+ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
 {
     u_char  c, ch, decoded, *p, *u;
     enum {
@@ -998,8 +1036,12 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r)
             switch(ch) {
 #if (NGX_WIN32)
             case '\\':
+                break;
 #endif
             case '/':
+                if (merge_slashes) {
+                    *u++ = ch;
+                }
                 break;
             case '.':
                 state = sw_dot;