diff --git a/changes-entries/pr69590.txt b/changes-entries/pr69590.txt new file mode 100644 index 0000000000..ebf3f1a5b0 --- /dev/null +++ b/changes-entries/pr69590.txt @@ -0,0 +1,2 @@ + *) mod_lua: Fix memory handling in LuaOutputFilter. PR 69590. + [Guillermo Grandes ] diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c index ed5c839fe9..793466ba68 100644 --- a/modules/lua/mod_lua.c +++ b/modules/lua/mod_lua.c @@ -473,14 +473,16 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade L = ctx->L; /* While the Lua function is still yielding, pass in buckets to the coroutine */ if (!ctx->broken) { - for (pbktIn = APR_BRIGADE_FIRST(pbbIn); - pbktIn != APR_BRIGADE_SENTINEL(pbbIn); - pbktIn = APR_BUCKET_NEXT(pbktIn)) - { + while (!APR_BRIGADE_EMPTY(pbbIn)) { const char *data; apr_size_t len; apr_bucket *pbktOut; + pbktIn = APR_BRIGADE_FIRST(pbbIn); + if (APR_BUCKET_IS_EOS(pbktIn)) { + break; + } + /* read the bucket */ apr_bucket_read(pbktIn,&data,&len,APR_BLOCK_READ); @@ -514,10 +516,11 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade lua_tostring(L, -1)); return HTTP_INTERNAL_SERVER_ERROR; } + apr_bucket_delete(pbktIn); } /* If we've safely reached the end, do a final call to Lua to allow for any finishing moves by the script, such as appending a tail. */ - if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) { + if (!APR_BRIGADE_EMPTY(pbbIn) && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) { apr_bucket *pbktEOS; lua_pushnil(L); lua_setglobal(L, "bucket");