From 48611f3ed27ec414a72d72fcd99e6a63fcb6f91d Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Wed, 12 Nov 2014 02:29:38 +0000 Subject: [PATCH] Fix a bug in r1604350 that can lead to crashes in the event MPM under load. if start_lingering_close_blocking() returns 0, notify_suspend() will write a 1 into some potentially recently free'd memory from ptrans (cs->suspended). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1638691 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 2 ++ server/mpm/event/event.c | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index 2b06a392bb..5aafa7de30 100644 --- a/CHANGES +++ b/CHANGES @@ -1,5 +1,7 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + + *) event: Resolve potential crashes under load after r1604350. [Eric Covener] *) mod_authnz_ldap: Resolve crashes with LDAP authz and non-LDAP authn since r1608202. [Eric Covener] diff --git a/server/mpm/event/event.c b/server/mpm/event/event.c index 24899cf511..2003977b63 100644 --- a/server/mpm/event/event.c +++ b/server/mpm/event/event.c @@ -1134,8 +1134,9 @@ read_request: } if (cs->pub.state == CONN_STATE_LINGER) { - start_lingering_close_blocking(cs); - notify_suspend(cs); + if (start_lingering_close_blocking(cs)) { + notify_suspend(cs); + } } else if (cs->pub.state == CONN_STATE_CHECK_REQUEST_LINE_READABLE) { /* It greatly simplifies the logic to use a single timeout value here -- 2.50.1