# HG changeset patch
# User Igor Sysoev <igor@sysoev.ru>
# Date 1171029762 0
# Node ID 04a8b485447d7211f83970a64d155f930105072b
# Parent  aed9dfe2a4f21b3b0d61c5b9c6ba2d33ed7c00f1
fix segfault when a large FastCGI response was written to a temporary file

diff --git a/src/event/ngx_event_pipe.c b/src/event/ngx_event_pipe.c
--- a/src/event/ngx_event_pipe.c
+++ b/src/event/ngx_event_pipe.c
@@ -419,6 +419,7 @@ ngx_event_pipe_read_upstream(ngx_event_p
 static ngx_int_t
 ngx_event_pipe_write_to_downstream(ngx_event_pipe_t *p)
 {
+    u_char            *prev;
     size_t             bsize;
     ngx_uint_t         flush, prev_last_shadow;
     ngx_chain_t       *out, **ll, *cl;
@@ -497,11 +498,17 @@ ngx_event_pipe_write_to_downstream(ngx_e
 
         /* bsize is the size of the busy recycled bufs */
 
+        prev = NULL;
         bsize = 0;
 
         for (cl = p->busy; cl; cl = cl->next) {
+            if (prev == cl->buf->start) {
+                continue;
+            }
+
             if (cl->buf->recycled) {
                 bsize += cl->buf->end - cl->buf->start;
+                prev = cl->buf->start;
             }
         }
 
@@ -509,8 +516,14 @@ ngx_event_pipe_write_to_downstream(ngx_e
                        "pipe write busy: %uz", bsize);
 
         out = NULL;
+
+        if (bsize >= (size_t) p->busy_size) {
+            flush = 1;
+            goto flush;
+        }
+
+        flush = 0;
         ll = NULL;
-        flush = 0;
         prev_last_shadow = 1;
 
         for ( ;; ) {
@@ -579,6 +592,8 @@ ngx_event_pipe_write_to_downstream(ngx_e
             ll = &cl->next;
         }
 
+    flush:
+
         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, p->log, 0,
                        "pipe write: out:%p, f:%d", out, flush);