From: Jeff Trawick <trawick@apache.org>
Date: Sat, 1 Oct 2005 11:02:10 +0000 (+0000)
Subject: merge from trunk:
X-Git-Tag: 2.1.9~80
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6e78bad8649571f4b16c84ef5c6fb274ab76dbba;p=thirdparty%2Fapache%2Fhttpd.git

merge from trunk:

*) SECURITY: CAN-2005-2970 (cve.mitre.org)
     worker MPM: Fix a memory leak which can occur after an aborted
     connection in some limited circumstances.  [Greg Ames, Jeff Trawick]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@292949 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 83e6234fc1f..4bf39c88857 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                         -*- coding: utf-8 -*-
 Changes with Apache 2.1.9
 
+  *) SECURITY: CAN-2005-2970 (cve.mitre.org)
+     worker MPM: Fix a memory leak which can occur after an aborted
+     connection in some limited circumstances.  [Greg Ames, Jeff Trawick]
+
   *) Doxygen fixup [Neale Ranns <neale ranns.org>, Ian Holsman]
 
   *) mod_cache/mod_dir: Correct a subrequest lookup bug which was preventing
diff --git a/server/mpm/worker/worker.c b/server/mpm/worker/worker.c
index 3dfdcc270a4..60e373696ff 100644
--- a/server/mpm/worker/worker.c
+++ b/server/mpm/worker/worker.c
@@ -724,6 +724,7 @@ static void *listener_thread(apr_thread_t *thd, void * dummy)
             }
             else {
                 ptrans = recycled_pool;
+                recycled_pool = NULL;
             }
             apr_pool_tag(ptrans, "transaction");
             rv = lr->accept_func(&csd, lr, ptrans);
@@ -760,11 +761,15 @@ static void *listener_thread(apr_thread_t *thd, void * dummy)
                     apr_socket_close(csd);
                     ap_log_error(APLOG_MARK, APLOG_CRIT, rv, ap_server_conf,
                                  "ap_queue_push failed");
+                    recycled_pool = ptrans;
                 }
                 else {
                     have_idle_worker = 0;
                 }
             }
+            else {
+                recycled_pool = ptrans;
+            }
         }
         else {
             if ((rv = SAFE_ACCEPT(apr_proc_mutex_unlock(accept_mutex)))