From: Jim Jagielski <jim@apache.org>
Date: Tue, 7 Jul 2020 16:56:32 +0000 (+0000)
Subject: Merge r1864868 from trunk:
X-Git-Tag: 2.4.44~38
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf7560b60ba7712875e3685b02b5ba851751037d;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1864868 from trunk:

Fix a signed/unsigned comparison that can never match.

-1 is a valid length value (for socket, pipe and cgi buckets for example)
All path I've checked cast the -1 to (apr_size_t) in order for the comparison to work. So do it as well here.

This has been like that in trunk since r708144, about 11 years ago, so I assume that it is not really an issue.

Spotted by gcc 9.1 and -Wextra
Submitted by: jailletc36
Reviewed by: jailletc36, minfrin, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879597 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/STATUS b/STATUS
index 9e9e20f9058..7b8cd669a76 100644
--- a/STATUS
+++ b/STATUS
@@ -155,11 +155,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
      2.4.x patch: svn merge -c 1705539,1877263,1877291,1879445 ^/httpd/httpd/trunk .
      +1: jailletc36, minfrin, jim
 
-  *) core: Fix a signed/unsigned comparison
-     trunk patch http://svn.apache.org/r1864868
-     2.4.x patch: svn merge -c 1864868 ^/httpd/httpd/trunk .
-     +1: jailletc36, minfrin, jim
-
   *) core: Drop an invalid Last-Modified header value coming
      from a (F)CGI script instead of replacing it with Unix epoch.
      Warn the users about Last-Modified header value replacements
diff --git a/server/core_filters.c b/server/core_filters.c
index a6c2bd666b2..290a1eb9ddb 100644
--- a/server/core_filters.c
+++ b/server/core_filters.c
@@ -270,7 +270,7 @@ apr_status_t ap_core_input_filter(ap_filter_t *f, apr_bucket_brigade *b,
             while ((len < readbytes) && (rv == APR_SUCCESS)
                    && (e != APR_BRIGADE_SENTINEL(ctx->b))) {
                 /* Check for the availability of buckets with known length */
-                if (e->length != -1) {
+                if (e->length != (apr_size_t)-1) {
                     len += e->length;
                     e = APR_BUCKET_NEXT(e);
                 }