From 04f21f8422dd763da2f09badac965ff03e59aca8 Mon Sep 17 00:00:00 2001
From: Jim Jagielski <jim@apache.org>
Date: Thu, 13 Jun 2019 11:09:12 +0000
Subject: [PATCH 2/5] Merge r1707084, r1707093, r1707159, r1707362 from trunk:

eor_bucket: don't destroy the request multiple times should any filter
do a copy (e.g. mod_bucketeer).

eor_bucket: follow up to r1707084: fix comment.

eor_bucket: follow up to r1707084: use an inner shared bucket.

eor_bucket: follow up to r1707159.
We need an apr_bucket_refcount, as spotted by Ruediger.
Submitted by: ylavic
Reviewed by: icing, covener, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1861248 13f79535-47bb-0310-9956-ffa450edef68
---
 server/eor_bucket.c | 43 ++++++++++++++++++++++++++++---------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/server/eor_bucket.c b/server/eor_bucket.c
index 4d3e1ec..ecb809c 100644
--- a/server/eor_bucket.c
+++ b/server/eor_bucket.c
@@ -19,17 +19,22 @@
 #include "http_protocol.h"
 #include "scoreboard.h"
 
+typedef struct {
+    apr_bucket_refcount refcount;
+    request_rec *data;
+} ap_bucket_eor;
+
 static apr_status_t eor_bucket_cleanup(void *data)
 {
-    apr_bucket *b = (apr_bucket *)data;
-    request_rec *r = (request_rec *)b->data;
+    request_rec **rp = data;
 
-    if (r != NULL) {
+    if (*rp) {
+        request_rec *r = *rp;
         /*
          * If eor_bucket_destroy is called after us, this prevents
          * eor_bucket_destroy from trying to destroy the pool again.
          */
-        b->data = NULL;
+        *rp = NULL;
         /* Update child status and log the transaction */
         ap_update_child_status(r->connection->sbh, SERVER_BUSY_LOG, r);
         ap_run_log_transaction(r);
@@ -50,11 +55,13 @@ static apr_status_t eor_bucket_read(apr_bucket *b, const char **str,
 
 AP_DECLARE(apr_bucket *) ap_bucket_eor_make(apr_bucket *b, request_rec *r)
 {
-    b->length      = 0;
-    b->start       = 0;
-    b->data        = r;
-    b->type        = &ap_bucket_type_eor;
+    ap_bucket_eor *h;
+
+    h = apr_bucket_alloc(sizeof(*h), b->list);
+    h->data = r;
 
+    b = apr_bucket_shared_make(b, h, 0, 0);
+    b->type = &ap_bucket_type_eor;
     return b;
 }
 
@@ -66,7 +73,9 @@ AP_DECLARE(apr_bucket *) ap_bucket_eor_create(apr_bucket_alloc_t *list,
     APR_BUCKET_INIT(b);
     b->free = apr_bucket_free;
     b->list = list;
+    b = ap_bucket_eor_make(b, r);
     if (r) {
+        ap_bucket_eor *h = b->data;
         /*
          * Register a cleanup for the request pool as the eor bucket could
          * have been allocated from a different pool then the request pool
@@ -76,18 +85,22 @@ AP_DECLARE(apr_bucket *) ap_bucket_eor_create(apr_bucket_alloc_t *list,
          * We need to use a pre-cleanup here because a module may create a
          * sub-pool which is still needed during the log_transaction hook.
          */
-        apr_pool_pre_cleanup_register(r->pool, (void *)b, eor_bucket_cleanup);
+        apr_pool_pre_cleanup_register(r->pool, &h->data, eor_bucket_cleanup);
     }
-    return ap_bucket_eor_make(b, r);
+    return b;
 }
 
 static void eor_bucket_destroy(void *data)
 {
-    request_rec *r = (request_rec *)data;
+    ap_bucket_eor *h = data;
 
-    if (r) {
-        /* eor_bucket_cleanup will be called when the pool gets destroyed */
-        apr_pool_destroy(r->pool);
+    if (apr_bucket_shared_destroy(h)) {
+        request_rec *r = h->data;
+        if (r) {
+            /* eor_bucket_cleanup will be called when the pool gets destroyed */
+            apr_pool_destroy(r->pool);
+        }
+        apr_bucket_free(h);
     }
 }
 
@@ -97,6 +110,6 @@ AP_DECLARE_DATA const apr_bucket_type_t ap_bucket_type_eor = {
     eor_bucket_read,
     apr_bucket_setaside_noop,
     apr_bucket_split_notimpl,
-    apr_bucket_simple_copy
+    apr_bucket_shared_copy
 };
 
-- 
1.8.3.1