Fix potential data corruption in apr_brigade_write() and friends if

the last bucket of the brigade is a heap bucket that has been split,
and there are still references to the next part of the original bucket
in use. 


git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1402897 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 20 insertions, 0 deletions

diff --git a/test/testbuckets.c b/test/testbuckets.c
index 954b474c5..ec65fa760 100644
--- a/test/testbuckets.c
+++ b/test/testbuckets.c
@@ -469,6 +469,25 @@ static void test_partition(abts_case *tc, void *data)
     apr_bucket_alloc_destroy(ba);
 }
 
+static void test_write_split(abts_case *tc, void *data)
+{
+    apr_bucket_alloc_t *ba = apr_bucket_alloc_create(p);
+    apr_bucket_brigade *bb1 = apr_brigade_create(p, ba);
+    apr_bucket_brigade *bb2;
+    apr_bucket *e;
+
+    e = apr_bucket_heap_create(hello, strlen(hello), NULL, ba);
+    APR_BRIGADE_INSERT_HEAD(bb1, e);
+    apr_bucket_split(e, strlen("hello, "));
+    bb2 = apr_brigade_split(bb1, APR_BRIGADE_LAST(bb1));
+    apr_brigade_write(bb1, NULL, NULL, "foo", strlen("foo"));
+    test_bucket_content(tc, APR_BRIGADE_FIRST(bb2), "world", 5);
+
+    apr_brigade_destroy(bb1);
+    apr_brigade_destroy(bb2);
+    apr_bucket_alloc_destroy(ba);
+}
+
 abts_suite *testbuckets(abts_suite *suite)
 {
     suite = ADD_SUITE(suite);
@@ -484,6 +503,7 @@ abts_suite *testbuckets(abts_suite *suite)
     abts_run_test(suite, test_manyfile, NULL);
     abts_run_test(suite, test_truncfile, NULL);
     abts_run_test(suite, test_partition, NULL);
+    abts_run_test(suite, test_write_split, NULL);
 
     return suite;
 }