Controllable read beyond bounds in lua_websocket_readbytes() [zhbug_httpd_126]

Greetings. I have found a read-beyond-bounds bug in lua_websocket_readbytes() that permits an attacker to exfiltrate a controllable amount of heap data if the victim site runs a suitable LUA program.

   2230: static apr_status_t lua_websocket_readbytes(conn_rec* c, char* buffer,
   2231:         apr_off_t len)
   2232: {
   2233:     apr_bucket_brigade *brigade = apr_brigade_create(c->pool, c->bucket_alloc);
   2234:     apr_status_t rv;
   2235:     rv = ap_get_brigade(c->input_filters, …