* server/util_filter.c (ap_filter_flush): Ensure that the brigade is

  empty before returning.

PR: 36780

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@583817 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/util_filter.c b/server/util_filter.c
index 5bd9e750aff0d72d6e8536d343d17df6a9483a83..a59dcd8b800a36f3025539226eb639c6a73fd31a 100644 (file)
--- a/server/util_filter.c
+++ b/server/util_filter.c
@@ -578,8 +578,19 @@ AP_DECLARE_NONSTD(apr_status_t) ap_filter_flush(apr_bucket_brigade *bb,
                                                 void *ctx)
 {
     ap_filter_t *f = ctx;
+    apr_status_t rv;
 
-    return ap_pass_brigade(f, bb);
+    rv = ap_pass_brigade(f, bb);
+
+    /* apr_brigade_write et all require that the flush callback
+     * ensures the brigade is empty upon return; otherwise the brigade
+     * may be left with a transient bucket whose contents have fallen
+     * out of scope.  Call cleanup here unconditionally, to avoid the
+     * issue even in error cases where some filter fails and leaves a
+     * non-empty brigade. */
+    apr_brigade_cleanup(bb);
+
+    return rv;
 }
 
 AP_DECLARE(apr_status_t) ap_fflush(ap_filter_t *f, apr_bucket_brigade *bb)