getline() fixes...

If ap_get_brigade() returns APR_SUCCESS but an empty brigade, bail out.
Previously, we kept going and sometimes segfaulted while operating on
what we thought was the first bucket.

Free the temporary brigade used by getline().

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@86581 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
index 02dbfa4e432b8cb32f16c402a750b4cda9157acd..5f4318393da6e3a684ef35855908ecd043347a5a 100644 (file)
--- a/modules/http/http_protocol.c
+++ b/modules/http/http_protocol.c
@@ -960,7 +960,9 @@ static int getline(char *s, int n, conn_rec *c, int fold)
 
     while (1) {
         if (AP_BRIGADE_EMPTY(b)) {
-            if (ap_get_brigade(c->input_filters, b, AP_GET_LINE) != APR_SUCCESS) {
+            if (ap_get_brigade(c->input_filters, b, AP_GET_LINE) != APR_SUCCESS ||
+                AP_BRIGADE_EMPTY(b)) {
+                ap_brigade_destroy(b);
                 return -1;
             }
         }
@@ -986,6 +988,7 @@ static int getline(char *s, int n, conn_rec *c, int fold)
             /* input line was larger than the caller's buffer */
             AP_BUCKET_REMOVE(e);
             ap_bucket_destroy(e);
+            ap_brigade_destroy(b);
             return -1;
         }
         
@@ -1033,6 +1036,7 @@ static int getline(char *s, int n, conn_rec *c, int fold)
             pos++;              /* bump past end of incomplete line      */
         }
     }
+    ap_brigade_destroy(b);
     return total;
 }