In core_output_filter(), reset nbytes to zero after calling

writev_it_all() in case we have another brigade to process.
Otherwise, nbytes is bogus for the second brigade and
writev_it_all() doesn't know when to quit (it loops).

In writev_it_all(), when compensating for bytes already sent
don't go beyond the number of iovs we were passed on input.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@86391 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_core.c b/modules/http/http_core.c
index b07ba3b13726ee8597dc7af11cb4445d051fa1e5..a910a546e79e5412a2dacd5b16668adea645afc2 100644 (file)
--- a/modules/http/http_core.c
+++ b/modules/http/http_core.c
@@ -2547,11 +2547,10 @@ static apr_status_t writev_it_all(apr_socket_t *s, struct iovec *vec, int nvec,
         if (bytes_written < len) {
             /* Skip over the vectors that have already been written */
             apr_size_t cnt = vec[i].iov_len;
-            while (n >= cnt) {
+            while (n >= cnt && i + 1 < nvec) {
                 i++;
                 cnt += vec[i].iov_len;
             }
-
             if (n < cnt) {
                 /* Handle partial write of vec i */
                 vec[i].iov_base = (char *) vec[i].iov_base + 
@@ -3383,6 +3382,7 @@ static int core_output_filter(ap_filter_t *f, ap_bucket_brigade *b)
             rv = writev_it_all(r->connection->client->bsock, 
                                vec, nvec, 
                                nbytes, &bytes_sent);
+            nbytes = 0; /* in case more points to another brigade */
         }
 
         ap_brigade_destroy(b);