From: Bill Stoddard <stoddard@apache.org>
Date: Wed, 24 Mar 2004 19:57:06 +0000 (+0000)
Subject: Can't assume the filepointer is really 0 when offset is 0. A handler can create briga... 
X-Git-Tag: pre_ajp_proxy~461
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bac83264dc32e3cb81774e4fb82fc248cc189744;p=apache

Can't assume the filepointer is really 0 when offset is 0. A handler can create brigades containing multiple file buckets with arbitrary offsets


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103125 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 84775fda20..c07b44533b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
 Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
+  *) core_output_filter: Fix bug that could result in sending
+     garbage over the network when module handlers construct
+     bucket brigades containing multiple file buckets all referencing
+     the same open file descriptor. [Bojan Smojver]
 
   *) Fix memory corruption problem with ap_custom_response() function.
      The core per-dir config would later point to request pool data
diff --git a/server/core.c b/server/core.c
index 9218ee0a75..0ed8ba9d54 100644
--- a/server/core.c
+++ b/server/core.c
@@ -2995,7 +2995,7 @@ static apr_status_t emulate_sendfile(core_net_rec *c, apr_file_t *fd,
     }
 
     /* Seek the file to 'offset' */
-    if (offset != 0 && rv == APR_SUCCESS) {
+    if (offset >= 0 && rv == APR_SUCCESS) {
         rv = apr_file_seek(fd, APR_SET, &offset);
     }