* APR_BUCKET_NEXT is wrong here as we are already a doing a APR_BUCKET_NEXT in

  the for loop and this causes us to jump *two* buckets forward. This can cause
  us to jump over the Sentinel of the brigade and thus causes an endless loop.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@755190 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index a50248f323de4f0b1676549872e67eb3128c971a..98beae2c2bcea0e6984a5ebc190a7e0fc2e1f995 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -199,7 +199,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }
@@ -249,7 +248,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }