From: Yann Ylavic <ylavic@apache.org>
Date: Wed, 2 Sep 2015 16:42:06 +0000 (+0000)
Subject: mod_negotiation: simplify type-map body tag lookup, and be safe
X-Git-Tag: 2.5.0-alpha~2877
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9f4af5d507129ec8fb8a42906227c6d3d8fee60f;p=thirdparty%2Fapache%2Fhttpd.git

mod_negotiation: simplify type-map body tag lookup, and be safe
should it contain a NUL byte.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1700851 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
index a68281a8418..84ce114ec38 100644
--- a/modules/mappers/mod_negotiation.c
+++ b/modules/mappers/mod_negotiation.c
@@ -828,33 +828,27 @@ static apr_off_t get_body(char *buffer, apr_size_t *len, const char *tag,
                           apr_file_t *map)
 {
     char *endbody;
-    int bodylen;
-    int taglen;
+    apr_size_t bodylen;
     apr_off_t pos;
 
-    taglen = strlen(tag);
-    *len -= taglen;
 
     /* We are at the first character following a body:tag\n entry
      * Suck in the body, then backspace to the first char after the
      * closing tag entry.  If we fail to read, find the tag or back
      * up then we have a hosed file, so give up already
      */
+    --*len; /* Reserve space for '\0' */
     if (apr_file_read(map, buffer, len) != APR_SUCCESS) {
         return -1;
     }
+    buffer[*len] = '\0';
 
-    /* put a copy of the tag *after* the data read from the file
-     * so that strstr() will find something with no reliance on
-     * terminating '\0'
-     */
-    memcpy(buffer + *len, tag, taglen);
-    endbody = strstr(buffer, tag);
-    if (endbody == buffer + *len) {
+    endbody = ap_strstr(buffer, tag);
+    if (!endbody) {
         return -1;
     }
     bodylen = endbody - buffer;
-    endbody += taglen;
+    endbody += strlen(tag);
     /* Skip all the trailing cruft after the end tag to the next line */
     while (*endbody) {
         if (*endbody == '\n') {