From 9629bb9e6bc371d5491ce02e08a468f6b4df4450 Mon Sep 17 00:00:00 2001
From: Brian Pane <brianp@apache.org>
Date: Sun, 24 Feb 2002 07:40:05 +0000
Subject: [PATCH] Fix for the code that handles SSI tokens that span multiple
 buckets: if a brigade containing an incomplete "<!--#" token has been set
 aside in ctx->ssi_tag_brigade, we need to retrieve and output the contents of
 that brigade if the next bucket (in the next brigade) doesn't actually
 complete the "<!--#".

As part of this commit, I've commented out the recent changes
to detect flush buckets in the brigade, due to segfaults.  (I
think the fix may be to add some checks for sentinels and EOS
when advancing to the next bucket after the flush bucket.)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@93557 13f79535-47bb-0310-9956-ffa450edef68
---
 modules/filters/mod_include.c | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 928fd64628..45a7e70ec5 100644
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -366,6 +366,9 @@ static apr_bucket *find_start_sequence(apr_bucket *dptr, include_ctx_t *ctx,
             break;
         }
 
+#if 0
+        /* XXX the bucket flush support is commented out for now
+         * because it was causing a segfault */
         if (APR_BUCKET_IS_FLUSH(dptr)) {
             apr_bucket *old = dptr; 
             dptr = APR_BUCKET_NEXT(old);
@@ -373,7 +376,9 @@ static apr_bucket *find_start_sequence(apr_bucket *dptr, include_ctx_t *ctx,
             ctx->output_now = 1;
             ctx->output_flush = 1;
         }
-        else if (ctx->bytes_parsed >= BYTE_COUNT_THRESHOLD) {
+        else
+#endif /* 0 */
+        if (ctx->bytes_parsed >= BYTE_COUNT_THRESHOLD) {
             ctx->output_now = 1;
         }
         else if (ctx->bytes_parsed > 0) {
@@ -442,20 +447,17 @@ static apr_bucket *find_start_sequence(apr_bucket *dptr, include_ctx_t *ctx,
 
             /* False alarm... 
              */
-            /* send out the unmatched part
-             */
-             
-            if ((ctx->parse_pos > 0) && (ctx->bytes_parsed == 0)) {
-                apr_bucket *tmp_buck;
-                tmp_buck = apr_bucket_pool_create(apr_pstrndup(ctx->pool,
-                                                               ctx->start_seq,
-                                                               ctx->parse_pos),
-                                                  ctx->parse_pos, 
-                                                  ctx->pool);
-                APR_BUCKET_INSERT_BEFORE(dptr, tmp_buck);
+            if (!APR_BRIGADE_EMPTY(ctx->ssi_tag_brigade)) {
+                for (;;) {
+                    apr_bucket *e = APR_BRIGADE_LAST(ctx->ssi_tag_brigade);
+                    if (e == APR_BRIGADE_SENTINEL(ctx->ssi_tag_brigade)) {
+                        break;
+                    }
+                    APR_BUCKET_REMOVE(e);
+                    APR_BRIGADE_INSERT_HEAD(bb, e);
+                }
             }
 
-
             ctx->state = PRE_HEAD;
         }
 
@@ -536,6 +538,9 @@ static apr_bucket *find_end_sequence(apr_bucket *dptr, include_ctx_t *ctx,
         if (APR_BUCKET_IS_EOS(dptr)) {
             break;
         }
+#if 0
+        /* XXX the bucket flush support is commented out for now
+         * because it was causing a segfault */
         if (APR_BUCKET_IS_FLUSH(dptr)) {
             apr_bucket *old = dptr; 
             dptr = APR_BUCKET_NEXT(old);
@@ -543,7 +548,9 @@ static apr_bucket *find_end_sequence(apr_bucket *dptr, include_ctx_t *ctx,
             ctx->output_now = 1;
             ctx->output_flush = 1;
         }
-        else if (ctx->bytes_parsed >= BYTE_COUNT_THRESHOLD) {
+        else
+#endif /* 0 */
+        if (ctx->bytes_parsed >= BYTE_COUNT_THRESHOLD) {
             ctx->output_now = 1;
         }
         else if (ctx->bytes_parsed > 0) {
-- 
2.50.1