unparsed_uri setting in ngx_http_subrequest?

[Brian Pane]

I think I've found a separate bug in ngx_http_subrequest:

ngx_http_core_module.c, line 2080 (in 0.8.33):
    sr->headers_in = r->headers_in;

This results in a bitwise copy of headers_in from the parent request
to the subrequest.  Inside headers_in is a list:
typedef struct {
    ngx_list_t                        headers;
    // ...
} ngx_http_headers_in_t;

When you do a bitwise copy of an ngx_list_t, you end up with a broken
list.  Specifically, sr->headers_in->list->last in the subrequest
points to the last node in the r->headers_in.list.part chain in the
parent request.  It should instead point to the last node in the
subrequest's sr->headers_in.list.part chain.

Thus if any module attempts to add more headers to the subrequest's
sr->headers_in, they actually will be added to the parent request's
r->headers_in instead.

I ran into this problem in a module that needs to add extra request
headers to a proxied subrequest.

-Brian