From: Ruediger Pluem <rpluem@apache.org>
Date: Sat, 1 Nov 2008 10:23:09 +0000 (+0000)
Subject: * Use distinct char pointers for sending and receiving buffers to avoid
X-Git-Tag: 2.3.0~184
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=07e868589ea2a7a1c2e967b5d6314e7432680468;p=thirdparty%2Fapache%2Fhttpd.git

* Use distinct char pointers for sending and receiving buffers to avoid
  destroying the pointer to the sending buffer in the ajp message if
  data is received from the backend before all data is sent to the
  backend.

PR: 45911


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@709666 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index c73c6fba65a..ef148ca2f91 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 Changes with Apache 2.3.0
 [ When backported to 2.2.x, remove entry from this file ]
 
+  *) mod_proxy_ajp: Do not fail if response data is sent before all request
+     data is read. PR 45911 [Ruediger Pluem]
+
   *) mod_authn_core: Prevent crash when provider alias created to
      provider which is not yet registered.  [Chris Darroch]
 
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
index 3ffd0321655..7be72bfe5c8 100644
--- a/modules/proxy/mod_proxy_ajp.c
+++ b/modules/proxy/mod_proxy_ajp.c
@@ -172,6 +172,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
     ajp_msg_t *msg;
     apr_size_t bufsiz = 0;
     char *buff;
+    char *send_body_chunk_buff;
     apr_uint16_t size;
     const char *tenc;
     int havebody = 1;
@@ -427,7 +428,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
                 break;
             case CMD_AJP13_SEND_BODY_CHUNK:
                 /* AJP13_SEND_BODY_CHUNK: piece of data */
-                status = ajp_parse_data(r, conn->data, &size, &buff);
+                status = ajp_parse_data(r, conn->data, &size, &send_body_chunk_buff);
                 if (status == APR_SUCCESS) {
                     /* AJP13_SEND_BODY_CHUNK with zero length
                      * is explicit flush message
@@ -443,7 +444,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
                         }
                     }
                     else {
-                        e = apr_bucket_transient_create(buff, size,
+                        e = apr_bucket_transient_create(send_body_chunk_buff, size,
                                                     r->connection->bucket_alloc);
                         APR_BRIGADE_INSERT_TAIL(output_brigade, e);