You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by tr...@apache.org on 2005/10/08 02:11:40 UTC
svn commit: r307222 - in /httpd/httpd/branches/2.2.x: CHANGES
server/mpm/worker/worker.c
Author: trawick
Date: Fri Oct 7 17:11:36 2005
New Revision: 307222
URL: http://svn.apache.org/viewcvs?rev=307222&view=rev
Log:
use Greg's cleaner fix for CAN-2005-2970
Modified:
httpd/httpd/branches/2.2.x/CHANGES
httpd/httpd/branches/2.2.x/server/mpm/worker/worker.c
Modified: httpd/httpd/branches/2.2.x/CHANGES
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.2.x/CHANGES?rev=307222&r1=307221&r2=307222&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.2.x/CHANGES [utf-8] Fri Oct 7 17:11:36 2005
@@ -24,7 +24,7 @@
*) SECURITY: CAN-2005-2970 (cve.mitre.org)
worker MPM: Fix a memory leak which can occur after an aborted
- connection in some limited circumstances. [Greg Ames, Jeff Trawick]
+ connection in some limited circumstances. [Greg Ames]
*) Doxygen fixup [Neale Ranns <neale ranns.org>, Ian Holsman]
Modified: httpd/httpd/branches/2.2.x/server/mpm/worker/worker.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.2.x/server/mpm/worker/worker.c?rev=307222&r1=307221&r2=307222&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/server/mpm/worker/worker.c (original)
+++ httpd/httpd/branches/2.2.x/server/mpm/worker/worker.c Fri Oct 7 17:11:36 2005
@@ -583,8 +583,7 @@
int process_slot = ti->pid;
apr_pool_t *tpool = apr_thread_pool_get(thd);
void *csd = NULL;
- apr_pool_t *ptrans; /* Pool for per-transaction stuff */
- apr_pool_t *recycled_pool = NULL;
+ apr_pool_t *ptrans = NULL; /* Pool for per-transaction stuff */
apr_pollset_t *pollset;
apr_status_t rv;
ap_listen_rec *lr;
@@ -624,8 +623,11 @@
if (listener_may_exit) break;
if (!have_idle_worker) {
+ /* the following pops a recycled ptrans pool off a stack
+ * if there is one, in addition to reserving a worker thread
+ */
rv = ap_queue_info_wait_for_idler(worker_queue_info,
- &recycled_pool);
+ &ptrans);
if (APR_STATUS_IS_EOF(rv)) {
break; /* we've been signaled to die now */
}
@@ -713,8 +715,9 @@
} /* if/else */
if (!listener_may_exit) {
- /* create a new transaction pool for each accepted socket */
- if (recycled_pool == NULL) {
+ if (ptrans == NULL) {
+ /* we can't use a recycled transaction pool this time.
+ * create a new transaction pool */
apr_allocator_t *allocator;
apr_allocator_create(&allocator);
@@ -722,10 +725,6 @@
apr_pool_create_ex(&ptrans, pconf, NULL, allocator);
apr_allocator_owner_set(allocator, ptrans);
}
- else {
- ptrans = recycled_pool;
- recycled_pool = NULL;
- }
apr_pool_tag(ptrans, "transaction");
rv = lr->accept_func(&csd, lr, ptrans);
/* later we trash rv and rely on csd to indicate success/failure */
@@ -761,14 +760,10 @@
apr_socket_close(csd);
ap_log_error(APLOG_MARK, APLOG_CRIT, rv, ap_server_conf,
"ap_queue_push failed");
- recycled_pool = ptrans;
}
else {
have_idle_worker = 0;
}
- }
- else {
- recycled_pool = ptrans;
}
}
else {