DO NOT REPLY [Bug 20619] New: - send_response_header() fails to copy status string's last character

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20619>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=20619

send_response_header() fails to copy status string's last character

           Summary: send_response_header() fails to copy status string's
                    last character
           Product: Apache httpd-2.0
           Version: 2.0.46
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_isapi
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: jsp@pkc.com


Lines 726-730 of mod_isapi.c read:

        newstat = apr_palloc(cid->r->pool, statlen + 9);
        strcpy(newstat, "Status: ");
        apr_cpystrn(newstat + 8, stat, statlen);
        stat = newstat;
        statlen += 8;

Because apr_cpystrn() reserves a byte for a terminal null and statlen is the
length of the status string to be copied, the final character of the status
string is replaced with a null when it is copied to newstat.  The apr_palloc()
call allocates sufficient space for the entire status string plus a terminal
null, so I think the only change required is in line 728:

        apr_cpystrn(newstat + 8, stat, statlen + 1);

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org