defect in ngx_mail_send function

[Zerray Zhou]

mail/ngx_mail_handler.c:561

561     if (n > 0) {
562         s->out.len -= n;
563
564         if (wev->timer_set) {
565             ngx_del_timer(wev);
566         }
567
568         if (s->quit) {
569             ngx_mail_close_connection(c);
570             return;
571         }
572
573         if (s->blocked) {
574             c->read->handler(c->read);
575         }
576
577         return;
578     }

the return statement in line 577, cause no more ngx_handle_write_event follow, so when n > 0 and n != s->out.len, it will wait for send forever
also for line 562, there should be followed by s->out.data += n, otherwise the data sent will be incorrect

[Maxim Dounin]

Thank you for report. While it's highly unlikely that this bug will be triggered as the ngx_mail_send() function is to send very short strings, it's certainly worth fixing. Here is a patch:

# HG changeset patch
# User Maxim Dounin <mdounin@mdounin.ru>
# Date 1395855107 -14400
#      Wed Mar 26 21:31:47 2014 +0400
# Node ID 808f5a9d5f8d9ec9de90da4f5ec43e36f146cb5d
# Parent  fc696386f9a92e67ca6d5f24ab687e1c27f5a1d8
Mail: fixed ngx_mail_send() (ticket #519).

diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
--- a/src/mail/ngx_mail_handler.c
+++ b/src/mail/ngx_mail_handler.c
@@ -559,8 +559,13 @@ ngx_mail_send(ngx_event_t *wev)
     n = c->send(c, s->out.data, s->out.len);
 
     if (n > 0) {
+        s->out.data += n;
         s->out.len -= n;
 
+        if (s->out.len != 0) {
+            goto again;
+        }
+
         if (wev->timer_set) {
             ngx_del_timer(wev);
         }
@@ -584,6 +589,8 @@ ngx_mail_send(ngx_event_t *wev)
 
     /* n == NGX_AGAIN */
 
+again:
+
     cscf = ngx_mail_get_module_srv_conf(s, ngx_mail_core_module);
 
     ngx_add_timer(c->write, cscf->timeout);

[Maxim Dounin <mdounin@…>]

In b42e7c790b81898d415012f94e06df5ba53483a6/nginx:

Mail: fixed ngx_mail_send() (ticket #519).

[Maxim Dounin]

Fix committed, thanks.