From: Amos Jeffries <squid3@treenet.co.nz>
Date: Tue, 28 Jul 2015 15:38:55 +0000 (-0700)
Subject: Fix several other xstrndup() instigated off-by-1 errors
X-Git-Tag: merge-candidate-3-v1~24^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=684f1580000064b59a59854ac09871c9fbda209b;p=thirdparty%2Fsquid.git

Fix several other xstrndup() instigated off-by-1 errors
---

diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index ecb223d15d..866f0fc96d 100644
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -1920,7 +1920,7 @@ ClientHttpRequest::handleAdaptedHeader(HttpMsg *msg)
          */
         xfree(uri);
         const SBuf tmp(request->effectiveRequestUri());
-        uri = xstrndup(tmp.rawContent(), tmp.length());
+        uri = xstrndup(tmp.rawContent(), tmp.length()+1);
         setLogUri(this, urlCanonicalClean(request));
         assert(request->method.id());
     } else if (HttpReply *new_rep = dynamic_cast<HttpReply*>(msg)) {
diff --git a/src/clients/FtpGateway.cc b/src/clients/FtpGateway.cc
index 4e22cf6e74..2a8c80aec5 100644
--- a/src/clients/FtpGateway.cc
+++ b/src/clients/FtpGateway.cc
@@ -1419,7 +1419,7 @@ ftpReadType(Ftp::Gateway * ftpState)
 
     if (code == 200) {
         const SBuf tmp = ftpState->request->url.path();
-        p = path = xstrndup(tmp.rawContent(),tmp.length());
+        p = path = xstrndup(tmp.rawContent(),tmp.length()+1);
 
         if (*p == '/')
             ++p;
@@ -2370,7 +2370,7 @@ ftpTrySlashHack(Ftp::Gateway * ftpState)
 
     /* Build the new path (urlpath begins with /) */
     const SBuf tmp = ftpState->request->url.path();
-    path = xstrndup(tmp.rawContent(), tmp.length());
+    path = xstrndup(tmp.rawContent(), tmp.length()+1);
     path[tmp.length()] = '\0';
 
     rfc1738_unescape(path);
diff --git a/src/urn.cc b/src/urn.cc
index 454b45f499..4e39a289eb 100644
--- a/src/urn.cc
+++ b/src/urn.cc
@@ -133,9 +133,9 @@ UrnState::getHost(const SBuf &urlpath)
     /** FIXME: this appears to be parsing the URL. *very* badly. */
     /*   a proper encapsulated URI/URL type needs to clear this up. */
     if ((p = urlpath.find(':')) != SBuf::npos) {
-        result = xstrndup(urlpath.rawContent(), p-1);
+        result = xstrndup(urlpath.rawContent(), (p-1) /*but xstrndup truncates*/+1 );
     } else {
-        result = xstrndup(urlpath.rawContent(), urlpath.length());
+        result = xstrndup(urlpath.rawContent(), urlpath.length()+1);
     }
     return result;
 }