From: Brian Pane <brianp@apache.org>
Date: Mon, 26 Nov 2001 08:49:29 +0000 (+0000)
Subject: Another fix for the core_output_filter() code that concatenates
X-Git-Tag: 2.0.29~16
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eb4b1ead89c29831811d90e436b2a983a3138589;p=thirdparty%2Fapache%2Fhttpd.git

Another fix for the core_output_filter() code that concatenates
small buckets: It's possible for the temporary brigade to
contain more than one bucket.  If this happens, we need to
recover the buckets after the first from the temporary brigade
before destroying it.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92176 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/server/core.c b/server/core.c
index caf2d84ac9d..7e015a99bb2 100644
--- a/server/core.c
+++ b/server/core.c
@@ -3080,7 +3080,7 @@ static apr_status_t core_output_filter(ap_filter_t *f, apr_bucket_brigade *b)
                     if (!fd) {
                         if (nvec == MAX_IOVEC_TO_WRITE) {
                             /* woah! too many. buffer them up, for use later. */
-                            apr_bucket *temp;
+                            apr_bucket *temp, *next;
                             apr_bucket_brigade *temp_brig;
 
                             temp_brig = apr_brigade_create(f->c->pool);
@@ -3097,9 +3097,16 @@ static apr_status_t core_output_filter(ap_filter_t *f, apr_bucket_brigade *b)
                             temp = APR_BRIGADE_FIRST(temp_brig);
                             APR_BUCKET_REMOVE(temp);
                             APR_BRIGADE_INSERT_HEAD(b, temp);
-                            apr_brigade_destroy(temp_brig);
                             e = temp;
                             last_e = e;
+                            for (next = APR_BRIGADE_FIRST(temp_brig);
+                                 next != APR_BRIGADE_SENTINEL(temp_brig);
+                                 next = APR_BRIGADE_FIRST(temp_brig)) {
+                                APR_BUCKET_REMOVE(next);
+                                APR_BUCKET_INSERT_AFTER(temp, next);
+                                temp = next;
+                            }
+                            apr_brigade_destroy(temp_brig);
                             nvec = 0;
                             apr_bucket_read(e, &str, &n, APR_BLOCK_READ);
                         }