php5-cgi/contribs7/php-4.3.7-handler.patch


Use ap_r* in the handler to fix bucket handling leak.

--- php-4.3.7/sapi/apache2handler/sapi_apache2.c.handler
+++ php-4.3.7/sapi/apache2handler/sapi_apache2.c
@@ -67,30 +67,15 @@
 static int
 php_apache_sapi_ub_write(const char *str, uint str_length TSRMLS_DC)
 {
-       apr_bucket *bucket;
-       apr_bucket_brigade *brigade;
        request_rec *r;
        php_struct *ctx;
-       char *copy_str;
-
-       if (str_length == 0) {
-               return 0;
-       }
 
        ctx = SG(server_context);
        r = ctx->r;
-       brigade = ctx->brigade;
        
-       copy_str = apr_pmemdup( r->pool, str, str_length);
-       bucket = apr_bucket_pool_create(copy_str, str_length, r->pool, r->connection->bucket_alloc);
-                                                
-       APR_BRIGADE_INSERT_TAIL(brigade, bucket);
-
-       if (ap_pass_brigade(r->output_filters, brigade) != APR_SUCCESS || r->connection->aborted) {
+       if (ap_rwrite(str, str_length, r) < 0) {
                php_handle_aborted_connection();
        }
-       /* Ensure this brigade is empty for the next usage. */
-       apr_brigade_cleanup(brigade);
        
        return str_length; /* we always consume all the data passed to us. */
 }
@@ -245,8 +230,6 @@
 php_apache_sapi_flush(void *server_context)
 {
        php_struct *ctx;
-       apr_bucket_brigade *brigade;
-       apr_bucket *bucket;
        request_rec *r;
        TSRMLS_FETCH();
 
@@ -259,20 +242,15 @@
        }
 
        r = ctx->r;
-       brigade = ctx->brigade;
 
        sapi_send_headers(TSRMLS_C);
 
        r->status = SG(sapi_headers).http_response_code;
        SG(headers_sent) = 1;
 
-       /* Send a flush bucket down the filter chain. */
-       bucket = apr_bucket_flush_create(r->connection->bucket_alloc);
-       APR_BRIGADE_INSERT_TAIL(brigade, bucket);
-       if (ap_pass_brigade(r->output_filters, brigade) != APR_SUCCESS || r->connection->aborted) {
+       if (ap_rflush(r) < 0 || r->connection->aborted) {
                php_handle_aborted_connection();
        }
-       apr_brigade_cleanup(brigade);
 }
 
 static void php_apache_sapi_log_message(char *msg)
1
2	Use ap_r* in the handler to fix bucket handling leak.
3
4	--- php-4.3.7/sapi/apache2handler/sapi_apache2.c.handler
5	+++ php-4.3.7/sapi/apache2handler/sapi_apache2.c
6	@@ -67,30 +67,15 @@
7	static int
8	php_apache_sapi_ub_write(const char *str, uint str_length TSRMLS_DC)
9	{
10	- apr_bucket *bucket;
11	- apr_bucket_brigade *brigade;
12	request_rec *r;
13	php_struct *ctx;
14	- char *copy_str;
15	-
16	- if (str_length == 0) {
17	- return 0;
18	- }
19
20	ctx = SG(server_context);
21	r = ctx->r;
22	- brigade = ctx->brigade;
23
24	- copy_str = apr_pmemdup( r->pool, str, str_length);
25	- bucket = apr_bucket_pool_create(copy_str, str_length, r->pool, r->connection->bucket_alloc);
26	-
27	- APR_BRIGADE_INSERT_TAIL(brigade, bucket);
28	-
29	- if (ap_pass_brigade(r->output_filters, brigade) != APR_SUCCESS \|\| r->connection->aborted) {
30	+ if (ap_rwrite(str, str_length, r) < 0) {
31	php_handle_aborted_connection();
32	}
33	- /* Ensure this brigade is empty for the next usage. */
34	- apr_brigade_cleanup(brigade);
35
36	return str_length; /* we always consume all the data passed to us. */
37	}
38	@@ -245,8 +230,6 @@
39	php_apache_sapi_flush(void *server_context)
40	{
41	php_struct *ctx;
42	- apr_bucket_brigade *brigade;
43	- apr_bucket *bucket;
44	request_rec *r;
45	TSRMLS_FETCH();
46
47	@@ -259,20 +242,15 @@
48	}
49
50	r = ctx->r;
51	- brigade = ctx->brigade;
52
53	sapi_send_headers(TSRMLS_C);
54
55	r->status = SG(sapi_headers).http_response_code;
56	SG(headers_sent) = 1;
57
58	- /* Send a flush bucket down the filter chain. */
59	- bucket = apr_bucket_flush_create(r->connection->bucket_alloc);
60	- APR_BRIGADE_INSERT_TAIL(brigade, bucket);
61	- if (ap_pass_brigade(r->output_filters, brigade) != APR_SUCCESS \|\| r->connection->aborted) {
62	+ if (ap_rflush(r) < 0 \|\| r->connection->aborted) {
63	php_handle_aborted_connection();
64	}
65	- apr_brigade_cleanup(brigade);
66	}
67
68	static void php_apache_sapi_log_message(char *msg)