Back out incorrect patch for 9932. Use the APR patch.

PR: 9932
Obtained from: APR Backport
Submitted by:
Reviewed by:

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96712 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/CHANGES b/src/CHANGES
index 0ae33c413a99a23b4559eadd637bea314f82a210..d1a896ce988d849859115687dcb60f1101901836 100644 (file)
--- a/src/CHANGES
+++ b/src/CHANGES
@@ -1,5 +1,11 @@
 Changes with Apache 1.3.27
 
+  *) Back out an older patch for PR 9932, which had some incorrect
+     behavior. Instead, use a backport of the APR fix. This has
+     the nice effect that ap_snprintf() can now distinguish between
+     an output which was truncated, and an output which exactly
+     filled the buffer. [Jim Jagielski]
+
   *) The cache in mod_proxy was incorrectly updating the Content-Length
      value (to 0) from 304 responses when doing validation. Bugz#10128
      [Paul Terry <paul.terry@gmx.net>, ast@domdv.de, Jim Jagielski]

diff --git a/src/ap/ap_snprintf.c b/src/ap/ap_snprintf.c
index 43f80fbd5e98ccef3e48a9ea5e53e53b16733303..ffa0c366dbe533991dbeed51b45d41d0d568a1cc 100644 (file)
--- a/src/ap/ap_snprintf.c
+++ b/src/ap/ap_snprintf.c
@@ -1158,10 +1158,7 @@ API_EXPORT(int) ap_vformatter(int (*flush_func)(ap_vformatter_buff *),
        fmt++;
     }
     vbuff->curpos = sp;
-    if (sp >= bep) {
-       if (flush_func(vbuff))
-           return -1;
-    }
+
     return cc;
 }
 

diff --git a/src/include/ap.h b/src/include/ap.h
index 4eee68b4851682d8c196873bd2197a32db38a7ce..0be49bf9a6db95dbf1462888c278e1ee09824d86 100644 (file)
--- a/src/include/ap.h
+++ b/src/include/ap.h
@@ -157,11 +157,13 @@ API_EXPORT(int) ap_vformatter(int (*flush_func)(ap_vformatter_buff *),
  * Process the format string until the entire string is exhausted, or
  * the buffer fills.  If the buffer fills then stop processing immediately
  * (so no further %n arguments are processed), and return the buffer
- * length.  In all cases the buffer is NUL terminated.
+ * length.  In all cases the buffer is NUL terminated. The return value
+ * is the number of characters placed in the buffer, excluding the
+ * terminating NUL. All this implies that, at most, (len-1) characters
+ * will be copied over; if the return value is >= len, then truncation
+ * occured.
  *
- * In no event does ap_snprintf return a negative number.  It's not possible
- * to distinguish between an output which was truncated, and an output which
- * exactly filled the buffer.
+ * In no event does ap_snprintf return a negative number.
  */
 API_EXPORT_NONSTD(int) ap_snprintf(char *buf, size_t len, const char *format,...)
                            __attribute__((format(printf,3,4)));

diff --git a/src/main/alloc.c b/src/main/alloc.c
index 9efb99e585e780f699ee65b6d487af45e206097b..d479b4473d6e59e0692a1d656c006ff5405a9af8 100644 (file)
--- a/src/main/alloc.c
+++ b/src/main/alloc.c
@@ -869,36 +869,44 @@ struct psprintf_data {
 #endif
 };
 
+#define AP_PSPRINTF_MIN_SIZE 32  /* Minimum size of allowable avail block */
+
 static int psprintf_flush(ap_vformatter_buff *vbuff)
 {
     struct psprintf_data *ps = (struct psprintf_data *)vbuff;
 #ifdef ALLOC_USE_MALLOC
-    int size;
+    int cur_len, size;
     char *ptr;
 
-    size = (char *)ps->vbuff.curpos - ps->base;
-    ptr = realloc(ps->base, 2*size);
+    cur_len = (char *)ps->vbuff.curpos - ps->base;
+    size = cur_len << 1;
+    if (size < AP_PSPRINTF_MIN_SIZE)
+        size = AP_PSPRINTF_MIN_SIZE;
+    ptr = realloc(ps->base, size);
     if (ptr == NULL) {
        fputs("Ouch!  Out of memory!\n", stderr);
        exit(1);
     }
     ps->base = ptr;
-    ps->vbuff.curpos = ptr + size;
-    ps->vbuff.endpos = ptr + 2*size - 1;
+    ps->vbuff.curpos = ptr + cur_len;
+    ps->vbuff.endpos = ptr + size - 1;
     return 0;
 #else
     union block_hdr *blok;
     union block_hdr *nblok;
-    size_t cur_len;
+    size_t cur_len, size;
     char *strp;
 
     blok = ps->blok;
     strp = ps->vbuff.curpos;
     cur_len = strp - blok->h.first_avail;
+    size = cur_len << 1;
+    if (size < AP_PSPRINTF_MIN_SIZE)
+        size = AP_PSPRINTF_MIN_SIZE;
 
     /* must try another blok */
     (void) ap_acquire_mutex(alloc_mutex);
-    nblok = new_block(2 * cur_len);
+    nblok = new_block(size);
     (void) ap_release_mutex(alloc_mutex);
     memcpy(nblok->h.first_avail, blok->h.first_avail, cur_len);
     ps->vbuff.curpos = nblok->h.first_avail + cur_len;
@@ -962,6 +970,8 @@ API_EXPORT(char *) ap_pvsprintf(pool *p, const char *fmt, va_list ap)
     ps.vbuff.endpos = ps.blok->h.endp - 1;     /* save one for NUL */
     ps.got_a_new_block = 0;
 
+    if (ps.blok->h.first_avail == ps.blok->h.endp)
+        psprintf_flush(&ps.vbuff);             /* ensure room for NUL */
     ap_vformatter(psprintf_flush, &ps.vbuff, fmt, ap);
 
     strp = ps.vbuff.curpos;