Request body: fixed client_body_in_file_only.

After introduction of chunked request body reading support in 1.3.9 (r4931),
the rb->bufs wasn't set if request body was fully preread while calling the
ngx_http_read_client_request_body() function.

Reported by Yichun Zhang (agentzh).

src/http/ngx_http_request_body.c

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index 749e4ae..cafc559 100644
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -35,7 +35,8 @@
     size_t                     preread;
     ssize_t                    size;
     ngx_int_t                  rc;
-    ngx_chain_t                out;
+    ngx_buf_t                 *b;
+    ngx_chain_t                out, *cl;
     ngx_http_request_body_t   *rb;
     ngx_http_core_loc_conf_t  *clcf;
 
@@ -128,6 +129,21 @@
                 rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
                 goto done;
             }
+
+            cl = ngx_chain_get_free_buf(r->pool, &rb->free);
+            if (cl == NULL) {
+                return NGX_HTTP_INTERNAL_SERVER_ERROR;
+            }
+
+            b = cl->buf;
+
+            ngx_memzero(b, sizeof(ngx_buf_t));
+
+            b->in_file = 1;
+            b->file_last = rb->temp_file->file.offset;
+            b->file = &rb->temp_file->file;
+
+            rb->bufs = cl;
         }
 
         post_handler(r);