Repository: nginx/nginx
File: src/http/v2/ngx_http_v2.c (C)

Code before:
                goto failed;
            }

        } else {
            /* compatibility for $http_host */

            if (ngx_http_v2_construct_host_header(r, &host) != NGX_OK) {
                goto failed;
            }
        }
    }

    if (r->headers_in.content_length) {
        r->headers_in.content_length_n =
                            ngx_atoof(r->headers_in.content_length->value.data,
                                      r->headers_in.content_length->value.len);

        if (r->headers_in.content_length_n == NGX_ERROR) {
            ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                          "client sent invalid \"Content-Length\" header");
            goto failed;
        }

        if (r->headers_in.content_length_n > 0 && r->stream->in_closed) {
            ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                          "client prematurely closed stream");

            r->stream->skip_data = 1;

            ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
            goto failed;
        }

    } else if (!r->stream->in_closed) {
        r->headers_in.chunked = 1;
    }

    if (r->method == NGX_HTTP_CONNECT) {
        ngx_log_error(NGX_LOG_INFO, fc->log, 0, "client sent CONNECT method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
        goto failed;
    }

    if (r->method == NGX_HTTP_TRACE) {
        ngx_log_error(NGX_LOG_INFO, fc->log, 0, "client sent TRACE method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
        goto failed;
    }

    h2c = r->stream->connection;


Review comment (suggestion):
Here a `ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST)`  call is needed, similar to the origin `ngx_http_process_request_header()`.

Code after:
                ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                              "client sent \":authority\" and \"Host\" headers "
                              "with different values");
                ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
                goto failed;
            }

        } else {
            /* compatibility for $http_host */

            if (ngx_http_v2_construct_host_header(r) != NGX_OK) {
                goto failed;
            }
        }
    }

    if (r->headers_in.content_length) {
        r->headers_in.content_length_n =
                            ngx_atoof(r->headers_in.content_length->value.data,
                                      r->headers_in.content_length->value.len);

        if (r->headers_in.content_length_n == NGX_ERROR) {
            ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                          "client sent invalid \"Content-Length\" header");
            ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
            goto failed;
        }

        if (r->headers_in.content_length_n > 0 && r->stream->in_closed) {
            ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                          "client prematurely closed stream");

            r->stream->skip_data = 1;

            ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
            goto failed;
        }

    } else if (!r->stream->in_closed) {
        r->headers_in.chunked = 1;
    }

    if (r->method == NGX_HTTP_CONNECT) {
        ngx_log_error(NGX_LOG_INFO, fc->log, 0, "client sent CONNECT method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);
        goto failed;
    }

    if (r->method == NGX_HTTP_TRACE) {
        ngx_log_error(NGX_LOG_INFO, fc->log, 0, "client sent TRACE method");
        ngx_http_finalize_request(r, NGX_HTTP_NOT_ALLOWED);