httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From j..@apache.org
Subject svn commit: r1638070 - in /httpd/httpd/branches/2.4.x: ./ CHANGES STATUS docs/manual/rewrite/advanced.xml modules/cache/mod_cache.c
Date Tue, 11 Nov 2014 11:45:36 GMT
Author: jim
Date: Tue Nov 11 11:45:35 2014
New Revision: 1638070

URL: http://svn.apache.org/r1638070
Log:
Merge r1632740 from trunk:

mod_cache: avoid unlikely access to freed memory.
Submitted by: ylavic
Reviewed/backported by: jim

Modified:
    httpd/httpd/branches/2.4.x/   (props changed)
    httpd/httpd/branches/2.4.x/CHANGES
    httpd/httpd/branches/2.4.x/STATUS
    httpd/httpd/branches/2.4.x/docs/manual/rewrite/advanced.xml   (props changed)
    httpd/httpd/branches/2.4.x/modules/cache/mod_cache.c

Propchange: httpd/httpd/branches/2.4.x/
------------------------------------------------------------------------------
  Merged /httpd/httpd/trunk:r1632740

Modified: httpd/httpd/branches/2.4.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?rev=1638070&r1=1638069&r2=1638070&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.4.x/CHANGES [utf-8] Tue Nov 11 11:45:35 2014
@@ -46,7 +46,8 @@ Changes with Apache 2.4.11
 
   *) mod_dav: Set r->status_line in dav_error_response. PR 55426.
 
-  *) mod_proxy_http: Avoid (unlikely) access to freed memory. [Yann Ylavic]
+  *) mod_proxy_http, mod_cache: Avoid (unlikely) accesses to freed memory.
+     [Yann Ylavic, Christophe Jaillet]
 
   *) http_protocol: fix logic in ap_method_list_(add|remove) in order:
        - to correctly reset bits

Modified: httpd/httpd/branches/2.4.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/STATUS?rev=1638070&r1=1638069&r2=1638070&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/STATUS (original)
+++ httpd/httpd/branches/2.4.x/STATUS Tue Nov 11 11:45:35 2014
@@ -102,13 +102,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   * mod_cache: Avoid another (unlikely) access to freed memory.
-     trunk patch: http://svn.apache.org/r1632740
-     2.4.x patch: http://people.apache.org/~ylavic/httpd-2.4.x-apr_bucket_delete_new_fix.patch
-     +1: ylavic, jailletc36, trawick
-     ylavic: No CHANGES entry is added but rather the existing one for the same
-             issue in mod_proxy_http (2.4.11's backport r1632736) has been modified.
-
    * core: Support custom ErrorDocuments for HTTP 501 and 414 status codes.
      PR 57167 
      trunk patch: http://svn.apache.org/r1635762

Propchange: httpd/httpd/branches/2.4.x/docs/manual/rewrite/advanced.xml
------------------------------------------------------------------------------
  Merged /httpd/httpd/trunk/docs/manual/rewrite/advanced.xml:r1632740

Modified: httpd/httpd/branches/2.4.x/modules/cache/mod_cache.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/cache/mod_cache.c?rev=1638070&r1=1638069&r2=1638070&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/cache/mod_cache.c (original)
+++ httpd/httpd/branches/2.4.x/modules/cache/mod_cache.c Tue Nov 11 11:45:35 2014
@@ -641,7 +641,6 @@ static int cache_handler(request_rec *r)
 static apr_status_t cache_out_filter(ap_filter_t *f, apr_bucket_brigade *in)
 {
     request_rec *r = f->r;
-    apr_bucket *e;
     cache_request_rec *cache = (cache_request_rec *)f->ctx;
 
     if (!cache) {
@@ -657,10 +656,8 @@ static apr_status_t cache_out_filter(ap_
             "cache: running CACHE_OUT filter");
 
     /* clean out any previous response up to EOS, if any */
-    for (e = APR_BRIGADE_FIRST(in);
-         e != APR_BRIGADE_SENTINEL(in);
-         e = APR_BUCKET_NEXT(e))
-    {
+    while (!APR_BRIGADE_EMPTY(in)) {
+        apr_bucket *e = APR_BRIGADE_FIRST(in);
         if (APR_BUCKET_IS_EOS(e)) {
             apr_bucket_brigade *bb = apr_brigade_create(r->pool,
                     r->connection->bucket_alloc);



Mime
View raw message