From 09b9f4f85c5d97598ce07542c532d0f16e98d256 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Mon, 9 Apr 2012 09:35:35 +0000 Subject: [PATCH] Fix error handling in ap_scan_script_header_err_brigade() if there is no EOS bucket in the brigade: Also don't loop if there is a timeout when discarding the script output. Thanks to Edgar Frank for the analysis. PR: 48272 (partial fix) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1311174 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 4 ++++ server/util_script.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index dbf53664ed3..1da6ba3fcf3 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + *) core: Fix error handling in ap_scan_script_header_err_brigade() if there + is no EOS bucket in the brigade. Fixes segfault with mod_proxy_fcgi. + PR 48272. [Stefan Fritsch] + *) mod_proxy_fcgi: If there is an error reading the headers from the backend, send an error to the client. [Stefan Fritsch] diff --git a/server/util_script.c b/server/util_script.c index 18c4aea4ca4..f9f3e098039 100644 --- a/server/util_script.c +++ b/server/util_script.c @@ -553,7 +553,7 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer, if (!(l = strchr(w, ':'))) { if (!buffer) { /* Soak up all the script output - may save an outright kill */ - while ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data)) { + while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) { continue; } } @@ -672,7 +672,8 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg) apr_status_t rv; int done = 0; - while ((dst < dst_end) && !done && !APR_BUCKET_IS_EOS(e)) { + while ((dst < dst_end) && !done && e != APR_BRIGADE_SENTINEL(bb) + && !APR_BUCKET_IS_EOS(e)) { const char *bucket_data; apr_size_t bucket_data_len; const char *src; @@ -706,7 +707,7 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg) e = next; } *dst = 0; - return 1; + return done; } AP_DECLARE(int) ap_scan_script_header_err_brigade(request_rec *r, -- 2.47.3