41a6c3
# ./pullrev.sh 1553540
41a6c3
41a6c3
https://bugzilla.redhat.com/show_bug.cgi?id=1040447
41a6c3
41a6c3
http://svn.apache.org/viewvc?view=revision&revision=1553540
41a6c3
41a6c3
--- httpd-2.4.6/modules/proxy/mod_proxy_http.c
41a6c3
+++ httpd-2.4.6/modules/proxy/mod_proxy_http.c
41a6c3
@@ -710,7 +710,7 @@
41a6c3
         force10 = 0;
41a6c3
     }
41a6c3
 
41a6c3
-    header_brigade = apr_brigade_create(p, origin->bucket_alloc);
41a6c3
+    header_brigade = apr_brigade_create(p, bucket_alloc);
41a6c3
     rv = ap_proxy_create_hdrbrgd(p, header_brigade, r, p_conn,
41a6c3
                                  worker, conf, uri, url, server_portstr,
41a6c3
                                  &old_cl_val, &old_te_val);
41a6c3
@@ -1813,6 +1813,10 @@
41a6c3
         }
41a6c3
     } while (interim_response && (interim_response < AP_MAX_INTERIM_RESPONSES));
41a6c3
 
41a6c3
+    /* We have to cleanup bb brigade, because buckets inserted to it could be
41a6c3
+     * created from scpool and this pool can be freed before this brigade. */
41a6c3
+    apr_brigade_cleanup(bb);
41a6c3
+
41a6c3
     /* See define of AP_MAX_INTERIM_RESPONSES for why */
41a6c3
     if (interim_response >= AP_MAX_INTERIM_RESPONSES) {
41a6c3
         return ap_proxyerror(r, HTTP_BAD_GATEWAY,