From: Stefan Fritsch <sf@apache.org>
Date: Mon, 9 Apr 2012 09:35:35 +0000 (+0000)
Subject: Fix error handling in ap_scan_script_header_err_brigade() if there
X-Git-Tag: 2.5.0-alpha~7230
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=165e11ee96012a0a5c6caa6f48f7417334617ac5;p=apache

Fix error handling in ap_scan_script_header_err_brigade() if there
is no EOS bucket in the brigade:

Also don't loop if there is a timeout when discarding the script output.

Thanks to Edgar Frank for the analysis.

PR: 48272 (partial fix)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1311174 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index dbf53664ed..1da6ba3fcf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) core: Fix error handling in ap_scan_script_header_err_brigade() if there
+     is no EOS bucket in the brigade. Fixes segfault with mod_proxy_fcgi.
+     PR 48272. [Stefan Fritsch]
+
   *) mod_proxy_fcgi: If there is an error reading the headers from the
      backend, send an error to the client. [Stefan Fritsch]
 
diff --git a/server/util_script.c b/server/util_script.c
index 18c4aea4ca..f9f3e09803 100644
--- a/server/util_script.c
+++ b/server/util_script.c
@@ -553,7 +553,7 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
         if (!(l = strchr(w, ':'))) {
             if (!buffer) {
                 /* Soak up all the script output - may save an outright kill */
-                while ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data)) {
+                while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) {
                     continue;
                 }
             }
@@ -672,7 +672,8 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg)
     apr_status_t rv;
     int done = 0;
 
-    while ((dst < dst_end) && !done && !APR_BUCKET_IS_EOS(e)) {
+    while ((dst < dst_end) && !done && e != APR_BRIGADE_SENTINEL(bb)
+           && !APR_BUCKET_IS_EOS(e)) {
         const char *bucket_data;
         apr_size_t bucket_data_len;
         const char *src;
@@ -706,7 +707,7 @@ static int getsfunc_BRIGADE(char *buf, int len, void *arg)
         e = next;
     }
     *dst = 0;
-    return 1;
+    return done;
 }
 
 AP_DECLARE(int) ap_scan_script_header_err_brigade(request_rec *r,