mirror of
https://github.com/apache/httpd.git
synced 2025-07-30 20:03:10 +03:00
ap_rgetline_core: set the number of bytes read & copied into the caller's
buffer when returning APR_ENOSPC. This prevents seg faults in ap_get_mime_headers_core in an error path which handles headers that are too long. Submitted by: Jeff Trawick git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99079 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
@ -290,6 +290,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
|
||||
|
||||
/* Would this overrun our buffer? If so, we'll die. */
|
||||
if (n < bytes_handled + len) {
|
||||
*read = bytes_handled;
|
||||
return APR_ENOSPC;
|
||||
}
|
||||
|
||||
@ -390,6 +391,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
|
||||
last_char = *s + bytes_handled - 1;
|
||||
}
|
||||
else {
|
||||
*read = n;
|
||||
return APR_ENOSPC;
|
||||
}
|
||||
}
|
||||
@ -519,6 +521,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
|
||||
return APR_SUCCESS;
|
||||
}
|
||||
else {
|
||||
*read = n;
|
||||
return APR_ENOSPC;
|
||||
}
|
||||
}
|
||||
|
Reference in New Issue
Block a user