Setting lr = NULL on line 399 leads the the loop

closing early (see line 343) and the ap_listeners list being
nonsense.

End result is a segfault if something is already listening on ::
on our port when httpd is started.

Submitted by:	Colm MacCarthaigh <colm@stdlib.net>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101338 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/listen.c b/server/listen.c
index 778894e5a9dda03a54a0de8cf1d5e299b2599dfb..3b6c6d8cebafc0dea09af93cd515b4ecfec90205 100644 (file)
--- a/server/listen.c
+++ b/server/listen.c
@@ -395,8 +395,13 @@ static int ap_listen_open(apr_pool_t *pool, apr_port_t port)
                         ap_listeners = lr->next;
                     }
 
-                    /* So that previous becomes NULL in the next iteration */
-                    lr = NULL;
+                    /* Although we've removed ourselves from the list,
+                     * we need to make sure that the next iteration won't
+                     * consider "previous" a working IPv6 '::' socket.
+                     * Changing the family is enough to make sure the
+                     * conditions before make_sock() fail.
+                     */
+                    lr->bind_addr->family = AF_INET;
 
                     continue;
                 }