You are viewing a plain text version of this content. The canonical link for it is here.
Posted to apreq-dev@httpd.apache.org by Max Kellermann <ma...@duempel.org> on 2005/07/08 15:03:18 UTC
[PATCH] fix off-by-one error in apreq_brigade_move()
Hi,
the function apreq_brigade_move() is bugged: it wants the "first
bucket after the move", but calls APR_RING_UNSPLICE() which wants the
"last element to unsplice". This creates a off-by-one error which
shows up when you read the request body which was filtered by
mod_apreq: many buckets are lost.
A patch is included in this email. It simply passes the previous
bucket as right-hand limit. I have commited it to svn, revision
209754.
Max
Re: [PATCH] fix off-by-one error in apreq_brigade_move()
Posted by Markus Wichitill <ma...@gmx.de>.
Joe Schaefer wrote:
> ++Max! This may also fix the weird leak people have been
> seeing with the prefetch code as well.
It does. Thanks.
Re: [PATCH] fix off-by-one error in apreq_brigade_move()
Posted by Joe Schaefer <jo...@sunstarsys.com>.
Max Kellermann <ma...@duempel.org> writes:
> Hi,
>
> the function apreq_brigade_move() is bugged: it wants the "first
> bucket after the move", but calls APR_RING_UNSPLICE() which wants the
> "last element to unsplice". This creates a off-by-one error which
> shows up when you read the request body which was filtered by
> mod_apreq: many buckets are lost.
>
> A patch is included in this email. It simply passes the previous
> bucket as right-hand limit. I have commited it to svn, revision
> 209754.
++Max! This may also fix the weird leak people have been
seeing with the prefetch code as well.
--
Joe Schaefer