Commit eaf1523b authored by Ruediger Pluem's avatar Ruediger Pluem
Browse files

* Use distinct char pointers for sending and receiving buffers to avoid 

  destroying the pointer to the sending buffer in the ajp message if
  data is received from the backend before all data is sent to the
  backend.

PR: 45911


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@709666 13f79535-47bb-0310-9956-ffa450edef68
parent 46ee443c

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,9 @@ 
Changes with Apache 2.3.0

[ When backported to 2.2.x, remove entry from this file ]



  *) mod_proxy_ajp: Do not fail if response data is sent before all request

     data is read. PR 45911 [Ruediger Pluem]



  *) mod_authn_core: Prevent crash when provider alias created to

     provider which is not yet registered.  [Chris Darroch]

modules/proxy/mod_proxy_ajp.c

+3 −2
Changes for modules/proxy/mod_proxy_ajp.c: 3 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -172,6 +172,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, 
    ajp_msg_t *msg;

    apr_size_t bufsiz = 0;

    char *buff;

    char *send_body_chunk_buff;

    apr_uint16_t size;

    const char *tenc;

    int havebody = 1;
@@ -427,7 +428,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, 
                break;

            case CMD_AJP13_SEND_BODY_CHUNK:

                /* AJP13_SEND_BODY_CHUNK: piece of data */

                status = ajp_parse_data(r, conn->data, &size, &buff);

                status = ajp_parse_data(r, conn->data, &size, &send_body_chunk_buff);

                if (status == APR_SUCCESS) {

                    /* AJP13_SEND_BODY_CHUNK with zero length

                     * is explicit flush message
@@ -443,7 +444,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, 
                        }

                    }

                    else {

                        e = apr_bucket_transient_create(buff, size,

                        e = apr_bucket_transient_create(send_body_chunk_buff, size,

                                                    r->connection->bucket_alloc);

                        APR_BRIGADE_INSERT_TAIL(output_brigade, e);