Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Wed, 9 Jun 2004 17:28:41 -0400 (EDT)
From: Cliff Woolley <jwoolley@virginia.edu>
To: dev@httpd.apache.org
Subject: Re: [PATCH] mod_deflate + mod_proxy bug
In-Reply-To: <40C77FDA.8020101@us.ibm.com>
Message-ID: <Pine.GSO.4.58.0406091726150.7009@cobra.cs.Virginia.EDU>
References: <40C77FDA.8020101@us.ibm.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

On Wed, 9 Jun 2004, Allan Edwards wrote:

> +            }
> +            else {
> +                /* this was a zero length response, remove gzip header bucket then pass down the EOS */
> +                APR_BUCKET_REMOVE(APR_BRIGADE_FIRST(ctx->bb));
> +                APR_BUCKET_REMOVE(e);
> +                APR_BRIGADE_INSERT_TAIL(ctx->bb, e);
> +                return ap_pass_brigade(f->next, ctx->bb);
> +            }

I haven't looked at the entire context of this, but if you remove a bucket
(brigade_first(ctx->bb) from a brigade without deleting it and without
having any extra pointers to it, you'll leak memory.

Also, what happens if e *is* the first bucket in the brigade?  Can that
occur?  I think that by coincidence given the implementation of
APR_BUCKET_REMOVE, nothing bad would happen by double-removing a given
bucket twice in a row, but in general that seems like a bad idea and
should be avoided.

--Cliff