Merge r1867970 from trunk:

* modules/generators/cgi_common.h (discard_script_output): Simplify
  slightly and ensure constant rather than unlimited memory
  consumption when discarding CGI script output (for e.g. a redirect
  response).

PR: 64096
Submitted by: jorton
Reviewed by: jorton, covener, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1873742 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index b10f1b82011bf327d8529cc33101d7de346e7334..8c2dd29365b5c28c6f98c568d1773db56335a771 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.42
 
+  *) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
+     output.  PR 64096.  [Joe Orton]
+
   *) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
      [Giovanni Bechis <giovanni paclan.it>, Jim Jagielski]
 

diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
index 8c4a2c63600b6cc0b10fea1333dc2d7d303c49fc..7e4b126c1055bee80384de41827100e77979d3d5 100644 (file)
--- a/modules/generators/mod_cgi.c
+++ b/modules/generators/mod_cgi.c
@@ -541,19 +541,15 @@ static void discard_script_output(apr_bucket_brigade *bb)
     apr_bucket *e;
     const char *buf;
     apr_size_t len;
-    apr_status_t rv;
 
     for (e = APR_BRIGADE_FIRST(bb);
-         e != APR_BRIGADE_SENTINEL(bb);
-         e = APR_BUCKET_NEXT(e))
+         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+         e = APR_BRIGADE_FIRST(bb))
     {
-        if (APR_BUCKET_IS_EOS(e)) {
-            break;
-        }
-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
-        if (rv != APR_SUCCESS) {
+        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
             break;
         }
+        apr_bucket_delete(e);
     }
 }
 

diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
index b827ed6ac450f19cedab0d64cbd8ece825415888..9f4282cf9624fd78aed054f1f42175e692ec3642 100644 (file)
--- a/modules/generators/mod_cgid.c
+++ b/modules/generators/mod_cgid.c
@@ -1275,19 +1275,15 @@ static void discard_script_output(apr_bucket_brigade *bb)
     apr_bucket *e;
     const char *buf;
     apr_size_t len;
-    apr_status_t rv;
 
     for (e = APR_BRIGADE_FIRST(bb);
-         e != APR_BRIGADE_SENTINEL(bb);
-         e = APR_BUCKET_NEXT(e))
+         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+         e = APR_BRIGADE_FIRST(bb))
     {
-        if (APR_BUCKET_IS_EOS(e)) {
-            break;
-        }
-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
-        if (rv != APR_SUCCESS) {
+        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
             break;
         }
+        apr_bucket_delete(e);
     }
 }