Remove incomplete cache_objects from the cache if the cache update fails. This

fixes a bug where the cache was referencing freed cache_objects.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@93903 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/experimental/mod_mem_cache.c b/modules/experimental/mod_mem_cache.c
index 5922121278a5167bbd382c1abd16f5250dff4539..e48c32c10f7ae2b8a05a12ca08e9f59c861f4315 100644 (file)
--- a/modules/experimental/mod_mem_cache.c
+++ b/modules/experimental/mod_mem_cache.c
@@ -198,6 +198,23 @@ static apr_status_t decrement_refcount(void *arg)
 {
     cache_object_t *obj = (cache_object_t *) arg;
 
+    /* If obj->complete is not set, the cache update failed and the
+     * object needs to be removed from the cache.
+     */
+    if (!obj->complete) {
+        mem_cache_object_t *mobj = (mem_cache_object_t *) obj->vobj;
+        if (sconf->lock) {
+            apr_thread_mutex_lock(sconf->lock);
+        }
+        apr_hash_set(sconf->cacheht, obj->key, strlen(obj->key), NULL);
+        sconf->object_cnt--;
+        sconf->cache_size -= mobj->m_len;
+        if (sconf->lock) {
+            apr_thread_mutex_unlock(sconf->lock);
+        }
+    }
+
+    /* Cleanup the cache object */
 #ifdef USE_ATOMICS
     if (!apr_atomic_dec(&obj->refcount)) {
         if (obj->cleanup) {