segfaults while using experimental code

[Aidas Kasparas]

Hello,

I used experimental code to be able to put files (using POST method, of
course) and authenticate users using client certificates. Server crashed
most of times (standard 1.3.9 + only mod_ssl 2.4.5) with Segmentation
fault. 

        Traceing lead to problem in the ssl_engine_io.c file. Attached patch
hopefully fixes this problem (altought no guarantees) - at least my
server does not crashes any more

-- 

Aidas Kasparas
Network Manager
Lifosa AB
*** ssl_engine_io.c.R   Mon Oct  4 22:28:56 1999
--- ssl_engine_io.c     Mon Oct  4 22:40:32 1999
***************
*** 161,176 ****
      
      if ((ss = ap_ctx_get(r->ctx, "ssl::io::suck")) == NULL)
          return;
      if (((ss->bufptr+ss->buflen)-(ss->pendptr+ss->pendlen)) < len) {
          /* "expand" buffer */
          int newlen;
          char *newptr;
          if (ss->buflen < len)
!             newlen = ss->buflen * 2;
          else
              newlen = ss->buflen + len;
          newptr = ap_palloc(r->pool, newlen);
!         memcpy(newptr, ss->bufptr, ss->buflen);
          ss->bufptr = newptr;
          ss->buflen = newlen;
      }
--- 161,183 ----
      
      if ((ss = ap_ctx_get(r->ctx, "ssl::io::suck")) == NULL)
          return;
+     /* XXX - This way we could "eat" a lot of memory if all the input will
+       be big and fragmented the way that every piece will require 
+       extention --AK */
      if (((ss->bufptr+ss->buflen)-(ss->pendptr+ss->pendlen)) < len) {
          /* "expand" buffer */
          int newlen;
          char *newptr;
          if (ss->buflen < len)
!           /* Let's make buffer big ENOUGHT --AK */
!             newlen = ss->buflen * 2 + len;
          else
              newlen = ss->buflen + len;
          newptr = ap_palloc(r->pool, newlen);
!       /* Copy just part with information */
!         memcpy(newptr, ss->bufptr, ss->pendptr-ss->bufptr + ss->pendlen);
!       /* "End" starts at another location */
!       ss->pendptr = newptr + (ss->pendptr - ss->bufptr);
          ss->bufptr = newptr;
          ss->buflen = newlen;
      }