Fix chunking. Two bugs fixed.

1)  don't put the trailing 0\r\n\r\n in lenstr; that buffer is
    already in use (pointed to by another transient bucket); using
    lenstr again overlays that other chunk header
2)  insert the bucket with the trailing "0\r\n\r\n" *before* the eos bucket
Submitted by:	Jeff Trawick <trawickj@bellsouth.net>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@86095 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_core.c b/modules/http/http_core.c
index 20355174fb695b7275da8e2da66416711d54bcd6..cb6761b04c4e690f43036973648117e156aac2e4 100644 (file)
--- a/modules/http/http_core.c
+++ b/modules/http/http_core.c
@@ -2942,7 +2942,7 @@ static int chunk_filter(ap_filter_t *f, ap_bucket_brigade *b)
     b->head->prev = dptr;
     dptr->next = b->head;
     b->head = dptr;
-    dptr = ap_bucket_heap_create("\r\n", 2, &tempint);
+    dptr = ap_bucket_transient_create("\r\n", 2, &tempint);
     if (hit_eos) {
         b->tail->prev->next = dptr;
         dptr->prev = b->tail->prev;
@@ -2954,11 +2954,12 @@ static int chunk_filter(ap_filter_t *f, ap_bucket_brigade *b)
     }
 
     if (hit_eos && len != 0) {
-        apr_snprintf(lenstr, 6, "0\r\n\r\n");
-        dptr = ap_bucket_transient_create(lenstr, 5, &tempint);
-        ap_brigade_append_buckets(b, dptr);
+        dptr = ap_bucket_transient_create("0\r\n\r\n", 5, &tempint);
+        b->tail->prev->next = dptr;
+        dptr->prev = b->tail->prev;
+        b->tail->prev = dptr;
+        dptr->next = b->tail;
     }
-        
 
     return ap_pass_brigade(f->next, b);
 }