Commit f65d9682 authored by dgaudet's avatar dgaudet
Browse files

Fix an off-by-1 bug in pregsub(). 

Reviewed by:	Randy, Ralf
Submitted by:	Alexei
Obtained from:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3@78346 13f79535-47bb-0310-9956-ffa450edef68
parent 5af30fe4

APACHE_1_2_X/src/CHANGES

+4 −0
Original line number Diff line number Diff line 
Changes with Apache 1.2.1

  

  *) pregsub had an off-by-1 in its error checking code. [Alexei Kosut]



Changes with Apache 1.2



Changes with Apache 1.2b11

APACHE_1_2_X/src/main/util.c

+2 −2
Original line number Diff line number Diff line
@@ -232,7 +232,7 @@ char *pregsub(pool *p, const char *input, const char *source, 
	    if (c == '\\' && (*src == '$' || *src == '&'))

		c = *src++;

	    len++;

	} else if (no <= nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {

	} else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {

	    len += pmatch[no].rm_eo - pmatch[no].rm_so;

	}
@@ -256,7 +256,7 @@ char *pregsub(pool *p, const char *input, const char *source, 
	    if (c == '\\' && (*src == '$' || *src == '&'))

		c = *src++;

	    *dst++ = c;

	} else if (no <= nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {

	} else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {

	    len = pmatch[no].rm_eo - pmatch[no].rm_so;

	    strncpy(dst, source + pmatch[no].rm_so, len);

	    dst += len;