From 1297a1fab7092981fece10aa161f753851cfb8b3 Mon Sep 17 00:00:00 2001
From: Thomas Porzelt <tp@cryosphere.de>
Date: Sun, 7 Feb 2010 22:49:54 +0100
Subject: [PATCH] [core] Fix crash in throttle pool handling

---
 include/lighttpd/connection.h |  1 +
 src/main/connection.c         | 12 +++++++-----
 src/main/plugin_core.c        |  2 +-
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/lighttpd/connection.h b/include/lighttpd/connection.h
index f93d101..c787165 100644
--- a/include/lighttpd/connection.h
+++ b/include/lighttpd/connection.h
@@ -64,6 +64,7 @@ struct liConnection {
 		struct {
 			liThrottlePool *ptr; /* NULL if not in any throttling pool */
 			GList lnk;
+			guint8 queue_ndx;
 			gboolean queued;
 			gint magazine;
 		} pool;
diff --git a/src/main/connection.c b/src/main/connection.c
index bc23aef..abb6e09 100644
--- a/src/main/connection.c
+++ b/src/main/connection.c
@@ -384,8 +384,10 @@ static void connection_cb(struct ev_loop *loop, ev_io *w, int revents) {
 
 				if (con->throttle.pool.ptr && con->throttle.pool.magazine <= MAX(write_max,0) && !con->throttle.pool.queued) {
 					liThrottlePool *pool = con->throttle.pool.ptr;
+					guint8 queue_ndx = con->wrk->ndx+pool->current_queue[con->wrk->ndx];
 					g_atomic_int_inc(&pool->num_cons);
-					g_queue_push_tail_link(pool->queues[con->wrk->ndx+pool->current_queue[con->wrk->ndx]], &con->throttle.pool.lnk);
+					g_queue_push_tail_link(pool->queues[queue_ndx], &con->throttle.pool.lnk);
+					con->throttle.pool.queue_ndx = queue_ndx;
 					con->throttle.pool.queued = TRUE;
 				}
 			}
@@ -579,7 +581,7 @@ void li_connection_reset(liConnection *con) {
 	if (con->throttle.pool.ptr) {
 		if (con->throttle.pool.queued) {
 			liThrottlePool *pool = con->throttle.pool.ptr;
-			g_queue_unlink(pool->queues[con->wrk->ndx+pool->current_queue[con->wrk->ndx]], &con->throttle.pool.lnk);
+			g_queue_unlink(pool->queues[con->throttle.pool.queue_ndx], &con->throttle.pool.lnk);
 			g_atomic_int_add(&con->throttle.pool.ptr->num_cons, -1);
 			con->throttle.pool.queued = FALSE;
 		}
@@ -595,7 +597,7 @@ void li_connection_reset(liConnection *con) {
 	if (con->throttle.ip.ptr) {
 		if (con->throttle.ip.queued) {
 			liThrottlePool *pool = con->throttle.ip.ptr;
-			g_queue_unlink(pool->queues[con->wrk->ndx+pool->current_queue[con->wrk->ndx]], &con->throttle.ip.lnk);
+			g_queue_unlink(pool->queues[con->throttle.pool.queue_ndx], &con->throttle.ip.lnk);
 			g_atomic_int_add(&con->throttle.ip.ptr->num_cons, -1);
 			con->throttle.ip.queued = FALSE;
 		}
@@ -673,7 +675,7 @@ static void li_connection_reset_keep_alive(liConnection *con) {
 	if (con->throttle.pool.ptr) {
 		if (con->throttle.pool.queued) {
 			liThrottlePool *pool = con->throttle.pool.ptr;
-			g_queue_unlink(pool->queues[con->wrk->ndx+pool->current_queue[con->wrk->ndx]], &con->throttle.pool.lnk);
+			g_queue_unlink(pool->queues[con->throttle.pool.queue_ndx], &con->throttle.pool.lnk);
 			g_atomic_int_add(&con->throttle.pool.ptr->num_cons, -1);
 			con->throttle.pool.queued = FALSE;
 		}
@@ -689,7 +691,7 @@ static void li_connection_reset_keep_alive(liConnection *con) {
 	if (con->throttle.ip.ptr) {
 		if (con->throttle.ip.queued) {
 			liThrottlePool *pool = con->throttle.ip.ptr;
-			g_queue_unlink(pool->queues[con->wrk->ndx+pool->current_queue[con->wrk->ndx]], &con->throttle.ip.lnk);
+			g_queue_unlink(pool->queues[con->throttle.pool.queue_ndx], &con->throttle.ip.lnk);
 			g_atomic_int_add(&con->throttle.ip.ptr->num_cons, -1);
 			con->throttle.ip.queued = FALSE;
 		}
diff --git a/src/main/plugin_core.c b/src/main/plugin_core.c
index 8379a66..7740050 100644
--- a/src/main/plugin_core.c
+++ b/src/main/plugin_core.c
@@ -1307,7 +1307,7 @@ static liHandlerResult core_handle_throttle_pool(liVRequest *vr, gpointer param,
 			vr->con->throttle.pool.magazine = 0;
 			if (vr->con->throttle.pool.queued) {
 				liThrottlePool *p = vr->con->throttle.pool.ptr;
-				g_queue_unlink(p->queues[vr->con->wrk->ndx+p->current_queue[vr->con->wrk->ndx]], &vr->con->throttle.ip.lnk);
+				g_queue_unlink(p->queues[vr->con->throttle.pool.queue_ndx], &vr->con->throttle.pool.lnk);
 				g_atomic_int_add(&p->num_cons, -1);
 			}
 		}