ap_get_mime_headers_core: alloc space for trailing null when folding

(backport fix for PR18170)

Submitted by: Peter Mayne <PeterMayne@SPAM_SUX.ap.spherion.com>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@99445 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index 8014f940db0d8d3c21e4cde0296a984d9baace25..432c2b2f519c7f9116538204e32e7925a69c16f4 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,5 +1,5 @@
 APACHE 2.0 STATUS:                                              -*-text-*-
-Last modified at [$Date: 2003/04/17 21:08:58 $]
+Last modified at [$Date: 2003/04/18 20:30:41 $]
 
 Release:
 
@@ -221,11 +221,6 @@ PATCHES TO PORT FROM 2.1
       corresponding to mpm_common.xml if that isn't something you're
       comfortable with doing)
 
-    * ap_get_mime_headers_core: alloc space for null terminator
-      while folding
-      server/protocol.c r1.128
-      +1: gregames, jerenkrantz, trawick
-
 CURRENT RELEASE NOTES:
 
     * Backwards compatibility is expected of future Apache 2.0 releases,

diff --git a/server/protocol.c b/server/protocol.c
index 3e30a97fc7eb2b1497579385a7db1ca6c0e31498..251b32bc34c572e344c37937039da9b56814b8c4 100644 (file)
--- a/server/protocol.c
+++ b/server/protocol.c
@@ -753,11 +753,12 @@ AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, apr_bucket_brigade *bb
                  * doing O(n) allocs and using O(n^2) space for
                  * continuations that span many many lines.
                  */
-                if (last_len + len > alloc_len) {
+                apr_size_t fold_len = last_len + len + 1; /* trailing null */
+                if (fold_len > alloc_len) {
                     char *fold_buf;
                     alloc_len += alloc_len;
-                    if (last_len + len > alloc_len) {
-                        alloc_len = last_len + len;
+                    if (fold_len > alloc_len) {
+                        alloc_len = fold_len;
                     }
                     fold_buf = (char *)apr_palloc(r->pool, alloc_len);
                     memcpy(fold_buf, last_field, last_len);