From: Ruediger Pluem <rpluem@apache.org>
Date: Sat, 15 Nov 2008 14:25:54 +0000 (+0000)
Subject: Merge r709666 from trunk:
X-Git-Tag: 2.2.11~69
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39adc016245b3393e6933689a69305029e83f36c;p=thirdparty%2Fapache%2Fhttpd.git

Merge r709666 from trunk:

* Use distinct char pointers for sending and receiving buffers to avoid
  destroying the pointer to the sending buffer in the ajp message if
  data is received from the backend before all data is sent to the
  backend.

PR: 45911

Submitted by: rpluem
Reviewed by: rpluem, jim, jfclere


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@714273 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index e42a1d03cea..703a373392d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.2.11
 
+  *) mod_proxy_ajp: Do not fail if response data is sent before all request
+     data is read. PR 45911 [Ruediger Pluem]
+
   *) mod_proxy_balancer: Add in forced recovery for balancer members if
      all are in error state. [Mladen Turk]
 
diff --git a/STATUS b/STATUS
index 572bafb68ee..7097ecbce50 100644
--- a/STATUS
+++ b/STATUS
@@ -85,13 +85,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-    * mod_proxy_ajp: Do not fail if response data is sent before all request
-      data is read.  PR 45911
-      Trunk version of patch:
-         http://svn.apache.org/viewvc?rev=709666&view=rev
-      Backport version for 2.2.x of patch:
-         Trunk version of patch works
-      +1: rpluem, jim, jfclere
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
index ed0cf51e026..c3b80e3d78a 100644
--- a/modules/proxy/mod_proxy_ajp.c
+++ b/modules/proxy/mod_proxy_ajp.c
@@ -172,6 +172,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
     ajp_msg_t *msg;
     apr_size_t bufsiz = 0;
     char *buff;
+    char *send_body_chunk_buff;
     apr_uint16_t size;
     const char *tenc;
     int havebody = 1;
@@ -427,7 +428,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
                 break;
             case CMD_AJP13_SEND_BODY_CHUNK:
                 /* AJP13_SEND_BODY_CHUNK: piece of data */
-                status = ajp_parse_data(r, conn->data, &size, &buff);
+                status = ajp_parse_data(r, conn->data, &size, &send_body_chunk_buff);
                 if (status == APR_SUCCESS) {
                     /* AJP13_SEND_BODY_CHUNK with zero length
                      * is explicit flush message
@@ -443,7 +444,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
                         }
                     }
                     else {
-                        e = apr_bucket_transient_create(buff, size,
+                        e = apr_bucket_transient_create(send_body_chunk_buff, size,
                                                     r->connection->bucket_alloc);
                         APR_BRIGADE_INSERT_TAIL(output_brigade, e);