You are viewing a plain text version of this content. The canonical link for it is here.

Posted to bugs@httpd.apache.org by bu...@apache.org on 2003/03/11 11:34:17 UTC

DO NOT REPLY [Bug 17864] New: - table_clear() corrupts memory

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=17864>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=17864

table_clear() corrupts memory

           Summary: table_clear() corrupts memory
           Product: Apache httpd-2.0
           Version: 2.0.44
          Platform: Other
        OS/Version: Other
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: andreasl67@yahoo.de


mod_ssl's table_clear() clears one bucket past the bucket array.

This is causes by an incorrect loop condition ( "<=" instead of "<" ).

Surprisingly, this bug does not exist in 1.3.27.

Correct (as in 1.3.27) 
  for (bucket_p = table_p->ta_buckets; bucket_p < bounds_p; bucket_p++) {

Wrong ( 2.0.44)
  for (bucket_p = table_p->ta_buckets; bucket_p <= bounds_p; bucket_p++) {

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org