svn commit: r1700851 - /httpd/httpd/trunk/modules/mappers/mod_negotiation.c

[yl...@apache.org]

Author: ylavic
Date: Wed Sep  2 16:42:06 2015
New Revision: 1700851

URL: http://svn.apache.org/r1700851
Log:
mod_negotiation: simplify type-map body tag lookup, and be safe
should it contain a NUL byte.

Modified:
    httpd/httpd/trunk/modules/mappers/mod_negotiation.c

Modified: httpd/httpd/trunk/modules/mappers/mod_negotiation.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_negotiation.c?rev=1700851&r1=1700850&r2=1700851&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/mappers/mod_negotiation.c (original)
+++ httpd/httpd/trunk/modules/mappers/mod_negotiation.c Wed Sep  2 16:42:06 2015
@@ -828,33 +828,27 @@ static apr_off_t get_body(char *buffer,
                           apr_file_t *map)
 {
     char *endbody;
-    int bodylen;
-    int taglen;
+    apr_size_t bodylen;
     apr_off_t pos;
 
-    taglen = strlen(tag);
-    *len -= taglen;
 
     /* We are at the first character following a body:tag\n entry
      * Suck in the body, then backspace to the first char after the
      * closing tag entry.  If we fail to read, find the tag or back
      * up then we have a hosed file, so give up already
      */
+    --*len; /* Reserve space for '\0' */
     if (apr_file_read(map, buffer, len) != APR_SUCCESS) {
         return -1;
     }
+    buffer[*len] = '\0';
 
-    /* put a copy of the tag *after* the data read from the file
-     * so that strstr() will find something with no reliance on
-     * terminating '\0'
-     */
-    memcpy(buffer + *len, tag, taglen);
-    endbody = strstr(buffer, tag);
-    if (endbody == buffer + *len) {
+    endbody = ap_strstr(buffer, tag);
+    if (!endbody) {
         return -1;
     }
     bodylen = endbody - buffer;
-    endbody += taglen;
+    endbody += strlen(tag);
     /* Skip all the trailing cruft after the end tag to the next line */
     while (*endbody) {
         if (*endbody == '\n') {