From 545ab3c2ffee3123ca43696da476b7f259250f98 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 7 Feb 2020 16:56:40 +0000 Subject: [PATCH] Merge r1867970 from trunk: * modules/generators/cgi_common.h (discard_script_output): Simplify slightly and ensure constant rather than unlimited memory consumption when discarding CGI script output (for e.g. a redirect response). PR: 64096 Submitted by: jorton Reviewed by: jorton, covener, rpluem git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1873742 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ modules/generators/mod_cgi.c | 12 ++++-------- modules/generators/mod_cgid.c | 12 ++++-------- 3 files changed, 11 insertions(+), 16 deletions(-) diff --git a/CHANGES b/CHANGES index b10f1b82011..8c2dd29365b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ -*- coding: utf-8 -*- Changes with Apache 2.4.42 + *) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script + output. PR 64096. [Joe Orton] + *) config: Speed up graceful restarts by using pre-hashed command table. PR 64066. [Giovanni Bechis , Jim Jagielski] diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c index 8c4a2c63600..7e4b126c105 100644 --- a/modules/generators/mod_cgi.c +++ b/modules/generators/mod_cgi.c @@ -541,19 +541,15 @@ static void discard_script_output(apr_bucket_brigade *bb) apr_bucket *e; const char *buf; apr_size_t len; - apr_status_t rv; for (e = APR_BRIGADE_FIRST(bb); - e != APR_BRIGADE_SENTINEL(bb); - e = APR_BUCKET_NEXT(e)) + e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); + e = APR_BRIGADE_FIRST(bb)) { - if (APR_BUCKET_IS_EOS(e)) { - break; - } - rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); - if (rv != APR_SUCCESS) { + if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { break; } + apr_bucket_delete(e); } } diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c index b827ed6ac45..9f4282cf962 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c @@ -1275,19 +1275,15 @@ static void discard_script_output(apr_bucket_brigade *bb) apr_bucket *e; const char *buf; apr_size_t len; - apr_status_t rv; for (e = APR_BRIGADE_FIRST(bb); - e != APR_BRIGADE_SENTINEL(bb); - e = APR_BUCKET_NEXT(e)) + e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); + e = APR_BRIGADE_FIRST(bb)) { - if (APR_BUCKET_IS_EOS(e)) { - break; - } - rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); - if (rv != APR_SUCCESS) { + if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { break; } + apr_bucket_delete(e); } } -- 2.47.3