Merge r755190 from trunk:

* APR_BUCKET_NEXT is wrong here as we are already a doing a APR_BUCKET_NEXT in
  the for loop and this causes us to jump *two* buckets forward. This can cause
  us to jump over the Sentinel of the brigade and thus causes an endless loop.

Submitted by: rpluem
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@766001 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index f994d8ed245111962fd36b08e851b2a38d7a5771..f54160179f4d1dbb2c3724b7a5e3d9da9b32d572 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -95,13 +95,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
- * mod_substitute: Avoid endless loops in substitution.
-   Trunk version of patch:
-      http://svn.apache.org/viewvc?rev=755190&view=rev
-   Backport version for 2.2.x of patch:
-      Trunk version of patch works
-   +1: rpluem, gregames, jim
-
  * mod_substitute: Fix a memory leak.
    Trunk version of patch:
       http://svn.apache.org/viewvc?rev=757741&view=rev

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index a50248f323de4f0b1676549872e67eb3128c971a..98beae2c2bcea0e6984a5ebc190a7e0fc2e1f995 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -199,7 +199,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }
@@ -249,7 +248,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }