commit 915ef4f7c85df3e69d8e37116f09ed3a5ac55f66
author Igor Sysoev <igor@sysoev.ru> Fri Feb 09 14:02:42 2007 +0000
committer Igor Sysoev <igor@sysoev.ru> Fri Feb 09 14:02:42 2007 +0000
tree e903f3b21b4fb995ada320063ec146491deaa17d
parent f15b839a8839577d19b9071c444bf1ce53ced656

fix segfault when a large FastCGI response was written to a temporary file

src/event/ngx_event_pipe.c

diff --git a/src/event/ngx_event_pipe.c b/src/event/ngx_event_pipe.c
index b8ff608..b91aafd 100644
--- a/src/event/ngx_event_pipe.c
+++ b/src/event/ngx_event_pipe.c
@@ -419,6 +419,7 @@
 static ngx_int_t
 ngx_event_pipe_write_to_downstream(ngx_event_pipe_t *p)
 {
+    u_char            *prev;
     size_t             bsize;
     ngx_uint_t         flush, prev_last_shadow;
     ngx_chain_t       *out, **ll, *cl;
@@ -497,11 +498,17 @@
 
         /* bsize is the size of the busy recycled bufs */
 
+        prev = NULL;
         bsize = 0;
 
         for (cl = p->busy; cl; cl = cl->next) {
+            if (prev == cl->buf->start) {
+                continue;
+            }
+
             if (cl->buf->recycled) {
                 bsize += cl->buf->end - cl->buf->start;
+                prev = cl->buf->start;
             }
         }
 
@@ -509,8 +516,14 @@
                        "pipe write busy: %uz", bsize);
 
         out = NULL;
-        ll = NULL;
+
+        if (bsize >= (size_t) p->busy_size) {
+            flush = 1;
+            goto flush;
+        }
+
         flush = 0;
+        ll = NULL;
         prev_last_shadow = 1;
 
         for ( ;; ) {
@@ -579,6 +592,8 @@
             ll = &cl->next;
         }
 
+    flush:
+
         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, p->log, 0,
                        "pipe write: out:%p, f:%d", out, flush);