Move the req_hdrs pointer from the cache_object_t to the cache_handle_t. Each

thread serving a request needs to update the req_hdrs pointer so it needs to
reside in r->pool (where the cache_handle_t resides).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95846 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 6c75a5079b718581f895ff92eaab0ffde15cbbd2..8cc7e58ebe3d4524303a4f9b17101679aca2be56 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 
 Changes with Apache 2.0.40
+  *) Fix segfault in mod_mem_cache most frequently observed when
+     serving the same file to multiple clients on an MP machine.
+     [Bill Stoddard]
 
   *) mod_rewrite can now set cookies  (RewriteRule (.*) - [CO=name:$1:.domain])
      [Brian Degenhardt <bmd@mp3.com>, Ian Holsman]

diff --git a/modules/experimental/cache_storage.c b/modules/experimental/cache_storage.c
index 81214cdefbfd040d7f330f4a878a6c1c68c03250..65462c39900729b38951eb9771023dfa8a77c688 100644 (file)
--- a/modules/experimental/cache_storage.c
+++ b/modules/experimental/cache_storage.c
@@ -170,7 +170,8 @@ int cache_select_url(request_rec *r, const char *types, char *url)
     const char *next = types;
     const char *type;
     apr_status_t rv;
-    cache_info *info;
+    cache_handle_t *h;
+    //    cache_info *info;
     char *key;
     cache_request_rec *cache = (cache_request_rec *) 
                          ap_get_module_config(r->request_config, &cache_module);
@@ -180,15 +181,14 @@ int cache_select_url(request_rec *r, const char *types, char *url)
         return rv;
     }
     /* go through the cache types till we get a match */
-    cache->handle = apr_palloc(r->pool, sizeof(cache_handle_t));
+    h = cache->handle = apr_palloc(r->pool, sizeof(cache_handle_t));
 
     while (next) {
         type = ap_cache_tokstr(r->pool, next, &next);
-        switch ((rv = cache_run_open_entity(cache->handle, r, type, key))) {
+        switch ((rv = cache_run_open_entity(h, r, type, key))) {
         case OK: {
             char *vary = NULL;
-            info = &(cache->handle->cache_obj->info);
-            if (cache_read_entity_headers(cache->handle, r) != APR_SUCCESS) {
+            if (cache_read_entity_headers(h, r) != APR_SUCCESS) {
                 /* TODO: Handle this error */
                 return DECLINED;
             }
@@ -205,7 +205,7 @@ int cache_select_url(request_rec *r, const char *types, char *url)
              * language negotiated document in a different language by mistake.
              * 
              * This code makes the assumption that the storage manager will
-             * cache the info->req_hdrs if the response contains a Vary
+             * cache the req_hdrs if the response contains a Vary
              * header.
              * 
              * RFC2616 13.6 and 14.44 describe the Vary mechanism.
@@ -228,7 +228,7 @@ int cache_select_url(request_rec *r, const char *types, char *url)
                  * request identical? If not, we give up and do a straight get
                  */
                 h1 = ap_table_get(r->headers_in, name);
-                h2 = ap_table_get(info->req_hdrs, name);
+                h2 = ap_table_get(h->req_hdrs, name);
                 if (h1 == h2) {
                     /* both headers NULL, so a match - do nothing */
                 }

diff --git a/modules/experimental/mod_cache.h b/modules/experimental/mod_cache.h
index b70b5df5ce334e95f535a90583fe628658f262e6..3b88f1845b8b022871bb99a52b01137b30325b54 100644 (file)
--- a/modules/experimental/mod_cache.h
+++ b/modules/experimental/mod_cache.h
@@ -202,7 +202,7 @@ struct cache_info {
     apr_time_t ius;    /*  If-UnModified_Since header value    */
     const char *im;         /* If-Match header value */
     const char *inm;         /* If-None-Match header value */
-    apr_table_t *req_hdrs;   /* These are the original request headers   */
+
 };
 
 /* cache handle information */
@@ -230,6 +230,7 @@ struct cache_handle {
     apr_status_t (*write_body)(cache_handle_t *h, request_rec *r, apr_bucket_brigade *b);
     apr_status_t (*read_headers) (cache_handle_t *h, request_rec *r);
     apr_status_t (*read_body) (cache_handle_t *h, apr_pool_t *p, apr_bucket_brigade *bb); 
+    apr_table_t *req_hdrs;   /* These are the original request headers */
 };
 
 /* per request cache information */

diff --git a/modules/experimental/mod_mem_cache.c b/modules/experimental/mod_mem_cache.c
index d3b3ae5c6397052888aa4d1f8c9ab8e2defdd7be..14cc2baba9f1ead51bbafe5d1e717579b56f8f89 100644 (file)
--- a/modules/experimental/mod_mem_cache.c
+++ b/modules/experimental/mod_mem_cache.c
@@ -621,7 +621,7 @@ static int open_entity(cache_handle_t *h, request_rec *r, const char *type, cons
     h->write_headers = &write_headers;
     h->remove_entity = &remove_entity;
     h->cache_obj = obj;
-
+    h->req_hdrs = NULL;  /* Pick these up in read_headers() */
     return OK;
 }
 
@@ -771,17 +771,15 @@ static apr_status_t read_headers(cache_handle_t *h, request_rec *r)
 {
     int rc;
     mem_cache_object_t *mobj = (mem_cache_object_t*) h->cache_obj->vobj;
-    cache_info *info = &(h->cache_obj->info);
  
-    info->req_hdrs = apr_table_make(r->pool, mobj->num_req_hdrs);
-
+    h->req_hdrs = apr_table_make(r->pool, mobj->num_req_hdrs);
     r->headers_out = apr_table_make(r->pool, mobj->num_header_out);
     r->subprocess_env = apr_table_make(r->pool, mobj->num_subprocess_env);
     r->notes = apr_table_make(r->pool, mobj->num_notes);
 
     rc = unserialize_table(mobj->req_hdrs,
                            mobj->num_req_hdrs,
-                           info->req_hdrs);
+                           h->req_hdrs);
     rc = unserialize_table( mobj->header_out,
                             mobj->num_header_out, 
                             r->headers_out);