Merge r1924095 from trunk:

mod_lua: Fix memory handling in output filters.

* modules/lua/mod_lua.c (lua_output_filter_handle): Fix brigade
  iteration to use constant memory.

Submitted by: G.Grandes <guillermo.grandes gmail.com>
PR: 69590
Github: closes #517
Reviewed by: jorton, rpluem, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1926063 13f79535-47bb-0310-9956-ffa450edef68

Author: notroj

changes-entries/pr69590.txt

@@ -0,0 +1,2 @@
+  *) mod_lua: Fix memory handling in LuaOutputFilter. PR 69590.
+     [Guillermo Grandes <guillermo.grandes gmail.com>]

modules/lua/mod_lua.c

@@ -473,14 +473,16 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
     L = ctx->L;
     /* While the Lua function is still yielding, pass in buckets to the coroutine */
     if (!ctx->broken) {
-        for (pbktIn = APR_BRIGADE_FIRST(pbbIn);
-            pbktIn != APR_BRIGADE_SENTINEL(pbbIn);
-            pbktIn = APR_BUCKET_NEXT(pbktIn))
-            {
+        while (!APR_BRIGADE_EMPTY(pbbIn)) {
             const char *data;
             apr_size_t len;
             apr_bucket *pbktOut;
 
+            pbktIn = APR_BRIGADE_FIRST(pbbIn);
+            if (APR_BUCKET_IS_EOS(pbktIn)) {
+                break;
+            }
+
             /* read the bucket */
             apr_bucket_read(pbktIn,&data,&len,APR_BLOCK_READ);
 
@@ -514,10 +516,11 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
                               lua_tostring(L, -1));
                 return HTTP_INTERNAL_SERVER_ERROR;
             }
+            apr_bucket_delete(pbktIn);
         }
         /* If we've safely reached the end, do a final call to Lua to allow for any 
         finishing moves by the script, such as appending a tail. */
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) {
+        if (!APR_BRIGADE_EMPTY(pbbIn) && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) {
             apr_bucket *pbktEOS;
             lua_pushnil(L);
             lua_setglobal(L, "bucket");