Stack corruption mysterie

[Joachim Zobel]

Hi. 

I have the following simple function.

/*
 * xml2_make_start_bucket
 */
apr_bucket *xml2_make_start_bucket(apr_bucket * b)
{
    bucket_node *bn = b->data;
    apr_bucket *end;

    if (bn->node->type != XML_ELEMENT_NODE
        && !IS_DOCUMENT_NODE(bn->node)) {
        return NULL;
    }

    apr_bucket_copy(b, &end);
    bn->end = end;

    return end;
}

The bucket b is a shared bucket of a user defined type. All happens on
linux x86_64. apr_bucket_copy is apr_bucket_shared_copy.

After calling the function the subsequent assert fails.

        apr_bucket *end = xml2_make_start_bucket(b);
        ap_assert(end == bn->end);

gdb shows me that the leading byte of end has been overwritten with 0. 

Any hints on what may be happening there?

Thanks,
Joachim