Fix for segfault that happened upon reaching EOS in an

intermediate SSI parsing state
Submitted by:	Justin Erenkrantz

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92488 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 02f889f068c023b635e7ef4d84d4f852b52e6b0a..6d65bb7e989249d0ab6800cf1d57e151f66c4f63 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -2700,7 +2700,7 @@ static apr_status_t send_parsed_content(apr_bucket_brigade **bb,
                   ap_escape_shell_cmd(r->pool, arg_copy));
     }
 
-    while (dptr != APR_BRIGADE_SENTINEL(*bb)) {
+    while (dptr != APR_BRIGADE_SENTINEL(*bb) || !APR_BUCKET_IS_EOS(dptr)) {
         /* State to check for the STARTING_SEQUENCE. */
         if ((ctx->state == PRE_HEAD) || (ctx->state == PARSE_HEAD)) {
             int do_cleanup = 0;
@@ -2943,6 +2943,18 @@ static apr_status_t send_parsed_content(apr_bucket_brigade **bb,
         }
     }
 
+    /* We have nothing more to send, stop now. */
+    if (APR_BUCKET_IS_EOS(dptr)) {
+        /* We might have something saved that we never completed, but send
+         * down unparsed.  This allows for <!-- at the end of files to be
+         * sent correctly. */
+        if (!APR_BRIGADE_EMPTY(ctx->ssi_tag_brigade)) {
+            APR_BRIGADE_CONCAT(ctx->ssi_tag_brigade, *bb);
+            return ap_pass_brigade(f->next, ctx->ssi_tag_brigade);
+        }
+        return ap_pass_brigade(f->next, *bb);
+    }
+
     /* If I am in the middle of parsing an SSI tag then I need to set aside
      *   the pertinent trailing buckets and pass on the initial part of the
      *   brigade. The pertinent parts of the next brigades will be added to