Removed the destruction of the bucket allocator prior to

clearing the transaction pool.  The bucket allocator will
now get destroyed when apr_pool_clear() invokes its cleanup
callback.  With the old logic, memory corruption was possible
if the pool contained any brigades that referenced any
buckets allocated from the bucket allocator.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@360257 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/mpm/experimental/event/event.c b/server/mpm/experimental/event/event.c
index 622a2464647854628c99b23de676674f10b6763d..38f187d1f8fb8ce35272ea860cc6f74c24a06fca 100644 (file)
--- a/server/mpm/experimental/event/event.c
+++ b/server/mpm/experimental/event/event.c
@@ -678,7 +678,6 @@ read_request:
 
     if (cs->state == CONN_STATE_LINGER) {
         ap_lingering_close(c);
-        apr_bucket_alloc_destroy(cs->bucket_alloc);
         apr_pool_clear(p);
         ap_push_pool(worker_queue_info, p);
         return 1;