Mailing-List: contact apreq-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (asf.osuosl.org: domain of bojan@rexursive.com designates
 203.171.74.242 as permitted sender)
Message-ID: <20060531081004.hcyfxx1bcocg4sg4@www.rexursive.com>
Date: Wed, 31 May 2006 08:10:04 +1000
From: Bojan Smojver <bojan@rexursive.com>
To: apreq-dev@httpd.apache.org
Subject: Re: Endless loop in split_on_bdry() of library/parser_multipart.c?
References: <1148955189.2956.132.camel@coyote.rexursive.com>
	<447CA52A.6090501@p6m7g8.com>
In-Reply-To: <447CA52A.6090501@p6m7g8.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset=ISO-8859-1;
	DelSp="Yes";
	format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
User-Agent: Internet Messaging Program (IMP) H3 (4.1.1)

Quoting "Philip M. Gollucci" <pgollucci@p6m7g8.com>:

> You might try using Apache2::DebugFilter to see what buckets are
> getting passed, but I think
> the apreq filter is hooked before that.

I'm guessing this is a Perl thing. I'm in C, so this probably isn't =20
going to be very useful. I'm watching the whole thing in gdb anyway.

> Being that bucket brigades are doubly linked circular lists, and the
> code is checking it hasn't looped on the list (aka ring) yet, it must
> be missing it.  Probably because it got removed from it (in).  Maybe we
> need to save the first bucket of the list somewhere. and change the
> comparison.

This code is hit when there is a partial match. In this particular =20
case, the boundary is set to "\r\n--LYNX". The partial match is "\r" =20
and off is set to 1. However, the ending condition seems to be never =20
met in that while loop.

To make matters worse, it's not as straightforward as one would think. =20
The whole thing seems to depend on how the buckets are lined up inside =20
the brigade. And, compiler options appear to affect the whole thing as =20
well. With -O2, I can see the problem. With -O0, I can't.

I'll keep looking...

--=20
Bojan