fix 2575

Author: CamJN

.clangd

@@ -2,5 +2,5 @@ CompileFlags:
   Add:
     - -xc++-header
     - -DINTELLISENSE
-    - -std=gnu++11
+    - -std=gnu++14
     - -ferror-limit=0

CHANGELOG

@@ -3,6 +3,7 @@ Release 6.1.1 (Not yet released)
  * [Ruby] Improve support for Ruby 4 and Frozen String Literals. Closes GH-2619.
  * [Ubuntu] Add packages for Ubuntu 25.10 "questing", remove packages for Ubuntu 25.04 "plucky".
  * Upgrade Boost from 1.87 -> 1.89.
+ * [Nginx] Fixes bug with unbuffered uploads. Closes GH-2575.
  * [Nginx] Upgrades preferred Nginx to 1.28.0 from 1.26.3.
  * [Nginx] The preferred PCRE2 version is now 10.46 (previously 10.45).
  * Updated various library versions used in precompiled binaries (used for e.g. gem installs):

src/nginx_module/ContentHandler.c

@@ -1302,6 +1302,7 @@ parse_status_line(ngx_http_request_t *r, passenger_context_t *context)
                 return NGX_HTTP_SCGI_PARSE_NO_HEADER;
             }
 
+            r->http_major = ch - '0';
             state = sw_major_digit;
             break;
 
@@ -1316,6 +1317,11 @@ parse_status_line(ngx_http_request_t *r, passenger_context_t *context)
                 return NGX_HTTP_SCGI_PARSE_NO_HEADER;
             }
 
+            if (r->http_major > 99) {
+                return NGX_HTTP_SCGI_PARSE_NO_HEADER;
+            }
+
+            r->http_major = r->http_major * 10 + (ch - '0');
             break;
 
         /* the first digit of minor HTTP version */
@@ -1324,6 +1330,7 @@ parse_status_line(ngx_http_request_t *r, passenger_context_t *context)
                 return NGX_HTTP_SCGI_PARSE_NO_HEADER;
             }
 
+            r->http_minor = ch - '0';
             state = sw_minor_digit;
             break;
 
@@ -1338,6 +1345,11 @@ parse_status_line(ngx_http_request_t *r, passenger_context_t *context)
                 return NGX_HTTP_SCGI_PARSE_NO_HEADER;
             }
 
+            if (r->http_minor > 99) {
+                return NGX_HTTP_SCGI_PARSE_NO_HEADER;
+            }
+
+            r->http_minor = r->http_minor * 10 + (ch - '0');
             break;
 
         /* HTTP status code */
@@ -1350,7 +1362,7 @@ parse_status_line(ngx_http_request_t *r, passenger_context_t *context)
                 return NGX_HTTP_SCGI_PARSE_NO_HEADER;
             }
 
-            context->status = context->status * 10 + ch - '0';
+            context->status = context->status * 10 + (ch - '0');
 
             if (++context->status_count == 3) {
                 state = sw_space_after_status;
@@ -1827,7 +1839,13 @@ passenger_content_handler(ngx_http_request_t *r)
     u->pipe->input_filter = ngx_event_pipe_copy_input_filter;
     u->pipe->input_ctx = r;
 
-    r->request_body_no_buffering = !slcf->upstream_config.request_buffering;
+    if (!slcf->upstream_config.request_buffering
+        && slcf->upstream_config.pass_request_body
+        && !r->headers_in.chunked) {
+        r->request_body_no_buffering = 1;
+    } else {
+        r->request_body_no_buffering = !slcf->upstream_config.request_buffering;
+    }
 
     rc = ngx_http_read_client_request_body(r, ngx_http_upstream_init);