diff options
| author | Tarmigan Casebolt <tarmigan+git@gmail.com> | 2009-11-14 13:10:57 -0800 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2009-11-15 22:14:51 -0800 |
| commit | 48aec1b1f14578ac7560c8be40890ebf52c91d78 (patch) | |
| tree | 6dc21f2786a198df8018550756d8018940d72e8d /http-backend.c | |
| parent | 4a5328d644b67be7fae1ff360e142d5dee4e63e9 (diff) | |
| download | git-48aec1b1f14578ac7560c8be40890ebf52c91d78.tar.gz | |
http-backend: Fix access beyond end of string.
Found with valgrind while looking for Content-Length corruption in
smart http.
Signed-off-by: Tarmigan Casebolt <tarmigan+git@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'http-backend.c')
| -rw-r--r-- | http-backend.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/http-backend.c b/http-backend.c index 7f48406d6d..8e08f057dd 100644 --- a/http-backend.c +++ b/http-backend.c @@ -615,7 +615,7 @@ int main(int argc, char **argv) if (regcomp(&re, c->pattern, REG_EXTENDED)) die("Bogus regex in service table: %s", c->pattern); if (!regexec(&re, dir, 1, out, 0)) { - size_t n = out[0].rm_eo - out[0].rm_so; + size_t n; if (strcmp(method, c->method)) { const char *proto = getenv("SERVER_PROTOCOL"); @@ -629,9 +629,10 @@ int main(int argc, char **argv) } cmd = c; + n = out[0].rm_eo - out[0].rm_so; cmd_arg = xmalloc(n); - strncpy(cmd_arg, dir + out[0].rm_so + 1, n); - cmd_arg[n] = '\0'; + memcpy(cmd_arg, dir + out[0].rm_so + 1, n-1); + cmd_arg[n-1] = '\0'; dir[out[0].rm_so] = 0; break; } |