Fix for the boundary case in which each character of an SSI directive

is in a separate bucket...the code in send_parsed_content() doesn't
expect a case where ctx->state==PARSE_DIRECTIVE but ctx->tag_start_buffer
is NULL.  So in found_start_sequence(), we set ctx->tag_start_buffer
to point to the next bucket if the end of the <!--# is at the very
end of the current bucket.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94454 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index c2d02c5a88ce763e115d81ff1777e53f229637bd..b663176575e7b07cd5ec6b03d364c656fe00b917 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -327,11 +327,17 @@ static apr_bucket* found_start_sequence(apr_bucket *dptr,
     ctx->tag_length = 0;
     ctx->parse_pos = 0;
 
-    /* Don't set tag_start_bucket if tagStart indexes the end of the bucket. */
+    /* If tagStart indexes the end of the bucket, then tag_start_bucket
+     * should be the next bucket
+     */
     if (tagStart < len) {
         ctx->tag_start_bucket = dptr;
         ctx->tag_start_index = tagStart;
     }
+    else {
+        ctx->tag_start_bucket = APR_BUCKET_NEXT(dptr);
+        ctx->tag_start_index = 0;
+    }
 
     if (ctx->head_start_index > 0) {
         apr_bucket *tmp_bkt;