Fix error handling in ap_scan_script_header_err_brigade() if there

is no EOS bucket in the brigade:

Also don't loop if there is a timeout when discarding the script output.

Thanks to Edgar Frank for the analysis.

PR: 48272 (partial fix)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1311174 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index dbf53664ed30c1fd697d61b6dc8c7c54700b8296..1da6ba3fcf320c3cb39c6f5f7cbb040adf6fb244 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) core: Fix error handling in ap_scan_script_header_err_brigade() if there
+     is no EOS bucket in the brigade. Fixes segfault with mod_proxy_fcgi.
+     PR 48272. [Stefan Fritsch]
+
   *) mod_proxy_fcgi: If there is an error reading the headers from the
      backend, send an error to the client. [Stefan Fritsch]
 

diff --git a/server/util_script.c b/server/util_script.c
index 18c4aea4ca46329f7bd627a61f3ed8f466d5412e..f9f3e098039e78bc177769a6afdcc1223dda45f2 100644 (file)
--- a/server/util_script.c
+++ b/server/util_script.c
@@ -553,7 +553,7 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
         if (!(l = strchr(w, ':'))) {
             if (!buffer) {
                 /* Soak up all the script output - may save an outright kill */
-                while ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data)) {
+                while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) {
                     continue;
                 }
             }
@@ -672,7 +672,8 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg)
     apr_status_t rv;
     int done = 0;
 
-    while ((dst < dst_end) && !done && !APR_BUCKET_IS_EOS(e)) {
+    while ((dst < dst_end) && !done && e != APR_BRIGADE_SENTINEL(bb)
+           && !APR_BUCKET_IS_EOS(e)) {
         const char *bucket_data;
         apr_size_t bucket_data_len;
         const char *src;
@@ -706,7 +707,7 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg)
         e = next;
     }
     *dst = 0;
-    return 1;
+    return done;
 }
 
 AP_DECLARE(int) ap_scan_script_header_err_brigade(request_rec *r,