Move a check for an empty brigade to the start of core input filter

to avoid segfaults.

Using prefork MPM and APR_POOL_DEBUG and ElectricFence, I found a
couple of paths where weren't able to report APR_EOF all the way
back up the call tree, leading us back into core_input_filter with
an empty brigade.

Some of the paths in core_input_filter handled it, some didn't.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92835 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index bb228c504004484a6093ccfd0390ce7bbde38d77..159f2b29de7649957172b750c4b66f74a2aff785 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 Changes with Apache 2.0.31-dev
 
+  *) Move a check for an empty brigade to the start of core input filter
+     to avoid segfaults.  [Justin Erenkrantz, Jeff Trawick]
+
   *) Add FileETag directive to allow configurable control of what
      data are used to form ETag values for file-based URIs.  MMN
      bumped to 20020111 because of fields added to the end of

diff --git a/server/core.c b/server/core.c
index 5ea35adf98705c8990788a84141ebf227fdc7108..3ab48440f8f1f42f27b25dde327257c05a0006d9 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -3035,6 +3035,10 @@ static int core_input_filter(ap_filter_t *f, apr_bucket_brigade *b, ap_input_mod
         APR_BRIGADE_INSERT_TAIL(ctx->b, e);
         net->in_ctx = ctx;
     }
+    else if (APR_BRIGADE_EMPTY(ctx->b)) {
+        /* hit EOF on socket already */
+        return APR_EOF;
+    }
 
     /* ### This is bad. */
     APR_BRIGADE_NORMALIZE(ctx->b);
@@ -3114,9 +3118,6 @@ static int core_input_filter(ap_filter_t *f, apr_bucket_brigade *b, ap_input_mod
 
         AP_DEBUG_ASSERT(*readbytes > 0);
         
-        if (APR_BRIGADE_EMPTY(ctx->b))
-            return APR_EOF;
-
         e = APR_BRIGADE_FIRST(ctx->b);
         rv = apr_bucket_read(e, &str, &len, mode);