apache Use of already freed subrequest data could lead to segmentation fault.

Function cgi_handler may create a CGI bucket using a subrequest. Subrequests may last shorter than the main request, and thus the bucket may end up dereferencing already freed data.
Bug fixed by commit bbeb0516cf0
Type UseAfterFree
Config APR_FILES_AS_SOCKETS (1st degree)
Fix-in code
Location modules/generators/
#include <stdlib.h>
#include <string.h>

void cgi_bucket_create(char *r)
  strcat(r, "something");

void cgi_handler(char *r)

int main(void)
  char *r = NULL;
  return 0;
. call modules/generators/mod_cgi.c:724:cgi_handler()
. // if APR_FILES_AS_SOCKETS is enabled
. 908: b = cgi_bucket_create(r, ...);
.. call modules/generators/mod_cgi.c:571:cgi_bucket_create()
.. ERROR 604: data->r = r;