Can't assume the filepointer is really 0 when offset is 0. A handler can create briga...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103125 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 84775fda20ddf883f43630156111ded869b9e8e7..c07b44533b28fea50c05cb4b259da20e63296762 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
 Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
+  *) core_output_filter: Fix bug that could result in sending
+     garbage over the network when module handlers construct
+     bucket brigades containing multiple file buckets all referencing
+     the same open file descriptor. [Bojan Smojver]
 
   *) Fix memory corruption problem with ap_custom_response() function.
      The core per-dir config would later point to request pool data

diff --git a/server/core.c b/server/core.c
index 9218ee0a7566a06d34e976421221c854a6701cb7..0ed8ba9d548c1edf71d61012a2d4713b1710cc00 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -2995,7 +2995,7 @@ static apr_status_t emulate_sendfile(core_net_rec *c, apr_file_t *fd,
     }
 
     /* Seek the file to 'offset' */
-    if (offset != 0 && rv == APR_SUCCESS) {
+    if (offset >= 0 && rv == APR_SUCCESS) {
         rv = apr_file_seek(fd, APR_SET, &offset);
     }