[PATCH] Fixed finalization of active subrequests without buffering

[Maxim Dounin]

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1787264836 -10800
#      Fri Aug 21 01:27:16 2026 +0300
# Node ID 6df24c964d3f26bf982659e4a64afc4389da0752
# Parent  629f14fee33eb5e7384318ceca122e355a99441e
Fixed finalization of active subrequests without buffering.

Previously, finalization of active subrequests without buffering did not
expect any additional write events, and did not change the write event
handler, preserving the value which was previously set.  However, in
some unusual code paths it is possible that the subrequest being
finalized will be in the posted request list, leading to the write event
handler being called after finalization, potentially causing issues
(known as CVE-2026-56434, though security impact is questionable).

In particular, such a situation was observed with SSI and proxying: when
an include was finalized and the main request was woken up, postponed
main request data were not flushed as long as the size of busy buffers
was below proxy_busy_buffers_size, and when another include arrived from
the upstream, it was posted from ngx_http_post_request() and then posted
again from the postpone filter.  With a static file as an include, this
caused "header already sent" alerts.

The fix is to set r->write_event_handler to the empty handler, similarly
to how it is handled in ngx_http_writer().

See also:
https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2680,6 +2680,8 @@ ngx_http_finalize_request(ngx_http_reque
                 pr->postponed = pr->postponed->next;
             }
 
+            r->write_event_handler = ngx_http_request_empty_handler;
+
             c->data = pr;
 
         } else {