From 15cb5a916dbc4a20332d8cf9f0819aa48a7c3c77 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Tue, 18 Aug 2026 18:27:25 -0400 Subject: [PATCH] mod_http2: preserve response metadata lifetime Copy response and trailer metadata into the stream pool before destroying their buckets. Otherwise the retained pointers reference nodes returned to the APR bucket allocator. Assisted-by: OpenAI Codex --- modules/http2/h2_stream.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c index 44969cf0881..d667df3b760 100644 --- a/modules/http2/h2_stream.c +++ b/modules/http2/h2_stream.c @@ -1169,7 +1169,7 @@ static apr_status_t stream_do_trailers(h2_stream *stream) if (APR_BUCKET_IS_METADATA(b)) { #if AP_HAS_RESPONSE_BUCKETS if (AP_BUCKET_IS_HEADERS(b)) { - headers = b->data; + headers = apr_pmemdup(stream->pool, b->data, sizeof(*headers)); #else /* AP_HAS_RESPONSE_BUCKETS */ if (H2_BUCKET_IS_HEADERS(b)) { headers = h2_bucket_headers_get(b); @@ -1609,7 +1609,7 @@ static apr_status_t stream_do_response(h2_stream *stream) if (APR_BUCKET_IS_METADATA(b)) { #if AP_HAS_RESPONSE_BUCKETS if (AP_BUCKET_IS_RESPONSE(b)) { - resp = b->data; + resp = apr_pmemdup(stream->pool, b->data, sizeof(*resp)); #else /* AP_HAS_RESPONSE_BUCKETS */ if (H2_BUCKET_IS_HEADERS(b)) { resp = h2_bucket_headers_get(b);