Commit 5cfcf8c9 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r755190 from trunk: 

* APR_BUCKET_NEXT is wrong here as we are already a doing a APR_BUCKET_NEXT in
  the for loop and this causes us to jump *two* buckets forward. This can cause
  us to jump over the Sentinel of the brigade and thus causes an endless loop.


Submitted by: rpluem
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@766001 13f79535-47bb-0310-9956-ffa450edef68
parent 83d5298a

STATUS

+0 −7
Original line number Diff line number Diff line
@@ -95,13 +95,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



 * mod_substitute: Avoid endless loops in substitution.

   Trunk version of patch:

      http://svn.apache.org/viewvc?rev=755190&view=rev

   Backport version for 2.2.x of patch:

      Trunk version of patch works

   +1: rpluem, gregames, jim



 * mod_substitute: Fix a memory leak.

   Trunk version of patch:

      http://svn.apache.org/viewvc?rev=757741&view=rev

modules/filters/mod_substitute.c

+0 −2
Original line number Diff line number Diff line
@@ -199,7 +199,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb, 
                        tmp_b = apr_bucket_transient_create(s1, strlen(s1),

                                            f->r->connection->bucket_alloc);

                        APR_BUCKET_INSERT_BEFORE(b, tmp_b);

                        tmp_b = APR_BUCKET_NEXT(b);

                        apr_bucket_delete(b);

                        b = tmp_b;

                    }
@@ -249,7 +248,6 @@ static void do_pattmatch(ap_filter_t *f, apr_bucket *inb, 
                        tmp_b = apr_bucket_transient_create(s1, strlen(s1),

                                            f->r->connection->bucket_alloc);

                        APR_BUCKET_INSERT_BEFORE(b, tmp_b);

                        tmp_b = APR_BUCKET_NEXT(b);

                        apr_bucket_delete(b);

                        b = tmp_b;

                    }