mod_fcgid/mod_fcgid-2.3.9-segfault-upload.patch

50 lines
1.6 KiB
Diff
Raw Normal View History

2020-08-27 13:00:51 +00:00
diff --git a/modules/fcgid/fcgid_proc_unix.c b/modules/fcgid/fcgid_proc_unix.c
index 218f3f7..8b69a89 100644
--- a/modules/fcgid/fcgid_proc_unix.c
+++ b/modules/fcgid/fcgid_proc_unix.c
@@ -762,14 +762,15 @@ apr_status_t proc_write_ipc(fcgid_ipc *ipc_handle,
struct iovec vec[FCGID_VEC_COUNT];
int nvec = 0;
apr_bucket *e;
+ apr_bucket_brigade* tmpbb = apr_brigade_create(output_brigade->p,output_brigade->bucket_alloc);
- for (e = APR_BRIGADE_FIRST(output_brigade);
- e != APR_BRIGADE_SENTINEL(output_brigade);
- e = APR_BUCKET_NEXT(e)) {
+ while (!APR_BRIGADE_EMPTY(output_brigade)) {
+ e = APR_BRIGADE_FIRST(output_brigade);
apr_size_t len;
const char* base;
if (APR_BUCKET_IS_METADATA(e)) {
+ apr_bucket_delete(e);
continue;
}
@@ -780,6 +781,9 @@ apr_status_t proc_write_ipc(fcgid_ipc *ipc_handle,
return rv;
}
+ APR_BUCKET_REMOVE(e);
+ APR_BRIGADE_INSERT_TAIL(tmpbb, e);
+
vec[nvec].iov_len = len;
vec[nvec].iov_base = (char*) base;
if (nvec == (FCGID_VEC_COUNT - 1)) {
@@ -789,6 +793,7 @@ apr_status_t proc_write_ipc(fcgid_ipc *ipc_handle,
FCGID_VEC_COUNT)) != APR_SUCCESS)
return rv;
nvec = 0;
+ apr_brigade_cleanup(tmpbb);
}
else
nvec++;
@@ -800,6 +805,7 @@ apr_status_t proc_write_ipc(fcgid_ipc *ipc_handle,
return rv;
}
+ apr_brigade_destroy(tmpbb);
return APR_SUCCESS;
}