Fix the logic for saving data onto the heap before sending it. Basically,

we have to use nbytes+flen when figuring out how much data we have,
and when looking at the fact that we have a buffer to save aside before
sending it, we also need to look at the length, to ensure that we aren't
saving too much.
Submitted by:	Bill Stoddard and Ryan Bloom

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@88972 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/core.c b/server/core.c
index 014cb78950031d8ec314c0efb5780a021fe685e2..518e478d9f6e2ba92965082202c46b243d55b842 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -3134,8 +3134,8 @@ static apr_status_t core_output_filter(ap_filter_t *f, apr_bucket_brigade *b)
          *       with the hope of concatenating with another response)
          */
         if ((!fd && !more && 
-             (nbytes < AP_MIN_BYTES_TO_WRITE) && !APR_BUCKET_IS_FLUSH(e))
-            || (APR_BUCKET_IS_EOS(e) && c->keepalive)) {
+            (nbytes + flen < AP_MIN_BYTES_TO_WRITE) && !APR_BUCKET_IS_FLUSH(e))
+            || (nbytes + flen < AP_MIN_BYTES_TO_WRITE && APR_BUCKET_IS_EOS(e) && c->keepalive)) {
             /* NEVER save an EOS in here.  If we are saving a brigade with 
              * an EOS bucket, then we are doing keepalive connections, and 
              * we want to process to second request fully.