From: Ruediger Pluem <rpluem@apache.org>
Date: Tue, 17 Mar 2009 11:10:14 +0000 (+0000)
Subject: * APR_BUCKET_NEXT is wrong here as we are already a doing a APR_BUCKET_NEXT in
X-Git-Tag: 2.3.2~12
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4bd3b107f140d5bde1a18b4190e40b9e5b6f9c23;p=apache

* APR_BUCKET_NEXT is wrong here as we are already a doing a APR_BUCKET_NEXT in
  the for loop and this causes us to jump *two* buckets forward. This can cause
  us to jump over the Sentinel of the brigade and thus causes an endless loop.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@755190 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index a50248f323..98beae2c2b 100644
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -199,7 +199,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }
@@ -249,7 +248,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         tmp_b = apr_bucket_transient_create(s1, strlen(s1),
                                             f->r->connection->bucket_alloc);
                         APR_BUCKET_INSERT_BEFORE(b, tmp_b);
-                        tmp_b = APR_BUCKET_NEXT(b);
                         apr_bucket_delete(b);
                         b = tmp_b;
                     }