diff options
| author | Ruediger Pluem <rpluem@apache.org> | 2007-01-24 22:08:44 +0100 |
|---|---|---|
| committer | Ruediger Pluem <rpluem@apache.org> | 2007-01-24 22:08:44 +0100 |
| commit | d8c62064ba606b88056ff6f2a3b1adae2d19727f (patch) | |
| tree | bf74bee12da4f838362c5dbcc52e8dcf4c3bf35f /modules | |
| parent | Point out that if another authorization method is used (diff) | |
| download | apache2-d8c62064ba606b88056ff6f2a3b1adae2d19727f.tar.xz apache2-d8c62064ba606b88056ff6f2a3b1adae2d19727f.zip | |
* Fix a off-by-one error in parse_format_tag in the case that the last character
of the string to which *sa points is a %. In this case the while loop in
parse_format_string would call parse_format_tag with a pointer to a memory
region that starts one byte after the string to which s in parse_format_string
points to.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@499567 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/metadata/mod_headers.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c index c7b2fc5d34..e139b5db9f 100644 --- a/modules/metadata/mod_headers.c +++ b/modules/metadata/mod_headers.c @@ -309,7 +309,9 @@ static char *parse_format_tag(apr_pool_t *p, format_tag *tag, const char **sa) if ((*s == '%') || (*s == '\0')) { tag->func = constant_item; tag->arg = "%"; - *sa = ++s; + if (*s) + s++; + *sa = s; return NULL; } |