Win32: Fix one byte overflow in ap_get_win32_interpreter when the CGI script

has no '\r' or '\n' in the first 1023 bytes.

Reported by: Aaron Campbell

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96464 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/main/http_core.c b/src/main/http_core.c
index b557586eaaa5fe89148c507a732e0b873dd317ff..b993a55133a6ba3f9aaee26abbfd9af9f3efaeb8 100644 (file)
--- a/src/main/http_core.c
+++ b/src/main/http_core.c
@@ -1041,7 +1041,7 @@ API_EXPORT (file_type_e) ap_get_win32_interpreter(const  request_rec *r,
     if ((buffer[0] == '#') && (buffer[1] == '!')) {
         /* Assuming file is a script since it starts with a shebang */
         fileType = eFileTypeSCRIPT;
-        for (i = 2; i < sizeof(buffer); i++) {
+        for (i = 2; i < (sizeof(buffer) - 1); i++) {
             if ((buffer[i] == '\r')
                 || (buffer[i] == '\n')) {
                 break;