Merge r179763 from trunk:

* modules/filters/mod_include.c (handle_include): Fix possible
variable corruption with nested includes.

PR: 12655
Reviewed by: jorton, nd, jerenkrantz

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@264762 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 683c5bd75b9311ba8f3916027ca89a50cfd0f4e2..445e96b7b98b4e0c4f4bd86f09ab8a4df0a3cb25 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.0.55
 
+  *) mod_include: Fix possible environment variable corruption when 
+     using nested includes.  PR 12655.  [Joe Orton]
+
   *) Support the suppress-error-charset setting, as with Apache 1.3.x.
      PR 31274.  [Jeff Trawick]
 

diff --git a/STATUS b/STATUS
index fa88e6d2ba5cbc279f8de91aeced47ca0bddf096..a3d39e93c5d29246cf12816f27f25630b27ce98d 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -198,14 +198,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
          modules/proxy/mod_proxy_ftp.c: r231044
        +1: minfrin, jim, nd
 
-    *) mod_include: Fix possible variable corruption with nested
-       includes.
-         http://svn.apache.org/viewcvs?rev=179763&view=rev
-       2.0.x patch: http://people.apache.org/~jorton/ap_pr12655.patch
-       test case in perl-framework/t/modules/include.t
-       PR: 12655
-       +1: jorton, nd, jerenkrantz
-
     *) mod_auth_digest: Fix hostinfo validation for CONNECT requests.
          http://svn.apache.org/viewcvs.cgi?rev=193127&view=rev
        +1: jorton, nd, jerenkrantz

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index ee45a086dace38abc03769032cd5e74ca463ea31..c1a252b5acf5912ff0d8b8003a468ba8f3d92ac5 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -788,11 +788,11 @@ static int handle_include(include_ctx_t *ctx, apr_bucket_brigade **bb,
                     CREATE_ERROR_BUCKET(ctx, tmp_buck, head_ptr, 
                                         *inserted_head);
                 }
-
-                /* destroy the sub request */
-                if (rr != NULL) {
-                    ap_destroy_sub_req(rr);
-                }
+                
+                /* Do *not* destroy the subrequest here; it may have allocated
+                 * variables in this r->subprocess_env in the subrequest's
+                 * r->pool, so that pool must survive as long as this request.
+                 * Yes, this is a memory leak. */
             }
             else {
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,