Fix up some length limit calculation

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1199410 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index a6004474e0a97196a673dde9c5d6b8567bf9700e..3fd0ad0692682711e5c76247a280ddb4299d44a9 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -246,15 +246,19 @@ static apr_status_t do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         }
                         else {
                             apr_size_t repl_len;
+                            /* acount for string before the match */
+                            if (space_left <= regm[0].rm_so)
+                                return APR_ENOMEM;
+                            space_left -= regm[0].rm_so;
                             rv = ap_pregsub_ex(pool, &repl,
                                                script->replacement, pos,
                                                AP_MAX_REG_MATCH, regm,
                                                space_left);
                             if (rv != APR_SUCCESS)
                                 return rv;
-                            len = (apr_size_t) (regm[0].rm_eo - regm[0].rm_so);
                             repl_len = strlen(repl);
-                            space_left -= len + repl_len;
+                            space_left -= repl_len;
+                            len = (apr_size_t) (regm[0].rm_eo - regm[0].rm_so);
                             SEDRMPATBCKT(b, regm[0].rm_so, tmp_b, len);
                             tmp_b = apr_bucket_transient_create(repl, repl_len,
                                                 f->r->connection->bucket_alloc);