Merge r225746 from trunk:

* modules/ldap/util_ldap_cache_mgr.c (util_ald_cache_insert): Fix a
cache corruption case: ensure that there is room in the cache for a
copy of the payload before inserting the node.

PR: 34209
Reviewed by: jorton, bnicholes, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@227332 13f79535-47bb-0310-9956-ffa450edef68

3 files changed, 11 insertions, 6 deletions

diff --git a/CHANGES b/CHANGES
index b0388c0513..b5293b51d9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.0.55
 
+  *) mod_ldap: Fix a possible crash in shared memory cache handling.
+     PR 34209.  [Joe Orton]
+
   *) Fix a file descriptor leak when starting piped loggers.  [Joe Orton]
 
   *) mod_ldap: Avoid segfaults when opening connections if using a version
diff --git a/STATUS b/STATUS
index 66f0cad72b..a35e02c95a 100644
--- a/STATUS
+++ b/STATUS
@@ -378,11 +378,6 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
         http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev
         +1: pquerna
 
-     *) mod_ldap: Fix cache corruption case.
-        http://svn.apache.org/viewcvs?rev=225746&view=rev
-        PR: 34209
-        +1: jorton, bnicholes, minfrin
-
      *) mod_ldap: Use the correct shm segment size, fail on
         apr_rmm_init errors.
         http://svn.apache.org/viewcvs?rev=225753&view=rev
diff --git a/modules/experimental/util_ldap_cache_mgr.c b/modules/experimental/util_ldap_cache_mgr.c
index 31c82be974..17483d5da8 100644
--- a/modules/experimental/util_ldap_cache_mgr.c
+++ b/modules/experimental/util_ldap_cache_mgr.c
@@ -402,11 +402,18 @@ void *util_ald_cache_insert(util_ald_cache_t *cache, void *payload)
         return NULL;
     }
 
+    /* Take a copy of the payload before proceeeding. */
+    payload = (*cache->copy)(cache, payload);
+    if (!payload) {
+        util_ald_free(cache, node);
+        return NULL;
+    }
+
     /* populate the entry */
     cache->inserts++;
     hashval = (*cache->hash)(payload) % cache->size;
     node->add_time = apr_time_now();
-    node->payload = (*cache->copy)(cache, payload);
+    node->payload = payload;
     node->next = cache->nodes[hashval];
     cache->nodes[hashval] = node;