Backport from HEAD:

* server/protocol.c (ap_rgetline_core): Never NUL terminate at
(*s)[-1] for caller-supplied *s.

Submitted by: Rici Lake <ricilake speedy.com.pe>
Reviewed by: jorton, jerenkrantz, trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@105278 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/protocol.c b/server/protocol.c
index 028bcb9beee8a1f1ede0f7b3feffdb5c187cdcd3..5d80a445a3fbd84c7cbe8a7f71b02b47da067a75 100644 (file)
--- a/server/protocol.c
+++ b/server/protocol.c
@@ -251,12 +251,12 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
         if (n < bytes_handled + len) {
             *read = bytes_handled;
             if (*s) {
-                /* ensure this string is terminated */
-                if (bytes_handled < n) {
+                /* ensure this string is NUL terminated */
+                if (bytes_handled > 0) {
                     (*s)[bytes_handled-1] = '\0';
                 }
                 else {
-                    (*s)[n-1] = '\0';
+                    (*s)[0] = '\0';
                 }
             }
             return APR_ENOSPC;