- Fix segfault in core_output_filter when we are passed an empty brigade.

- Stash the remainder of the brigade in more when we see a flush bucket.
  Previous to this commit, we would only process the buckets before the
  flush on a HTTP/1.0 request and then return.

We are proably only finding this now since we now correctly check for
keepalive connection status.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95896 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/core.c b/server/core.c
index cc988e737c95ae8eb688acc42dbdafedb0ccd957..da2b648558ac6c564c13e0ad8dfda1276679327f 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -3569,7 +3569,7 @@ static apr_status_t core_output_filter(ap_filter_t *f, apr_bucket_brigade *b)
 
     /* Perform multiple passes over the brigade, sending batches of output
        to the connection. */
-    while (b) {
+    while (b && !APR_BRIGADE_EMPTY(b)) {
         apr_size_t nbytes = 0;
         apr_bucket *last_e = NULL; /* initialized for debugging */
         apr_bucket *e;
@@ -3597,7 +3597,11 @@ static apr_status_t core_output_filter(ap_filter_t *f, apr_bucket_brigade *b)
         APR_BRIGADE_FOREACH(e, b) {
             /* keep track of the last bucket processed */
             last_e = e;
-            if (APR_BUCKET_IS_EOS(e) || APR_BUCKET_IS_FLUSH(e)) {
+            if (APR_BUCKET_IS_EOS(e)) {
+                break;
+            }
+            if (APR_BUCKET_IS_FLUSH(e)) {
+                more = apr_brigade_split(b, APR_BUCKET_NEXT(e));
                 break;
             }