]> git.ipfire.org Git - thirdparty/squid.git/commitdiff
Fix several other xstrndup() instigated off-by-1 errors
authorAmos Jeffries <squid3@treenet.co.nz>
Tue, 28 Jul 2015 15:38:55 +0000 (08:38 -0700)
committerAmos Jeffries <squid3@treenet.co.nz>
Tue, 28 Jul 2015 15:38:55 +0000 (08:38 -0700)
src/client_side_request.cc
src/clients/FtpGateway.cc
src/urn.cc

index ecb223d15dfa5a10f8edf83864788f8ab9a4c317..866f0fc96d74f5a3d2d6bd142405b4c11f6f80fa 100644 (file)
@@ -1920,7 +1920,7 @@ ClientHttpRequest::handleAdaptedHeader(HttpMsg *msg)
          */
         xfree(uri);
         const SBuf tmp(request->effectiveRequestUri());
-        uri = xstrndup(tmp.rawContent(), tmp.length());
+        uri = xstrndup(tmp.rawContent(), tmp.length()+1);
         setLogUri(this, urlCanonicalClean(request));
         assert(request->method.id());
     } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
index 4e22cf6e7408c1079113958b2d8bd6b4c0267bb3..2a8c80aec56401fd956f2a51802993c8dd73c673 100644 (file)
@@ -1419,7 +1419,7 @@ ftpReadType(Ftp::Gateway * ftpState)
 
     if (code == 200) {
         const SBuf tmp = ftpState->request->url.path();
-        p = path = xstrndup(tmp.rawContent(),tmp.length());
+        p = path = xstrndup(tmp.rawContent(),tmp.length()+1);
 
         if (*p == '/')
             ++p;
@@ -2370,7 +2370,7 @@ ftpTrySlashHack(Ftp::Gateway * ftpState)
 
     /* Build the new path (urlpath begins with /) */
     const SBuf tmp = ftpState->request->url.path();
-    path = xstrndup(tmp.rawContent(), tmp.length());
+    path = xstrndup(tmp.rawContent(), tmp.length()+1);
     path[tmp.length()] = '\0';
 
     rfc1738_unescape(path);
index 454b45f499dd16e3122839cf1670cf13868e01bf..4e39a289ebd3c470f041c5e88e2ccec040e5f20f 100644 (file)
@@ -133,9 +133,9 @@ UrnState::getHost(const SBuf &urlpath)
     /** FIXME: this appears to be parsing the URL. *very* badly. */
     /*   a proper encapsulated URI/URL type needs to clear this up. */
     if ((p = urlpath.find(':')) != SBuf::npos) {
-        result = xstrndup(urlpath.rawContent(), p-1);
+        result = xstrndup(urlpath.rawContent(), (p-1) /*but xstrndup truncates*/+1 );
     } else {
-        result = xstrndup(urlpath.rawContent(), urlpath.length());
+        result = xstrndup(urlpath.rawContent(), urlpath.length()+1);
     }
     return result;
 }