Fix a bug in r1604350 that can lead to crashes in the event MPM under load.

if start_lingering_close_blocking() returns 0, notify_suspend() will
write a 1 into some potentially recently free'd memory from
ptrans (cs->suspended).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1638691 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 2b06a392bbdc88ff2463aea60fc1632dc233b4a7..5aafa7de3020848cfc51429738c0efcc6b9b4f34 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
+  
+  *) event: Resolve potential crashes under load after r1604350. [Eric Covener]
 
   *) mod_authnz_ldap: Resolve crashes with LDAP authz and non-LDAP authn since 
      r1608202. [Eric Covener]

diff --git a/server/mpm/event/event.c b/server/mpm/event/event.c
index 24899cf511f9d973ffbc1cb6c0a64a35f85fece5..2003977b638a2fc80ce956c51dc70b8b2a5be463 100644 (file)
--- a/server/mpm/event/event.c
+++ b/server/mpm/event/event.c
@@ -1134,8 +1134,9 @@ read_request:
     }
 
     if (cs->pub.state == CONN_STATE_LINGER) {
-        start_lingering_close_blocking(cs);
-        notify_suspend(cs);
+        if (start_lingering_close_blocking(cs)) { 
+            notify_suspend(cs);
+        }
     }
     else if (cs->pub.state == CONN_STATE_CHECK_REQUEST_LINE_READABLE) {
         /* It greatly simplifies the logic to use a single timeout value here