MFH: Fixed bug #27037 (fixed possible crash in apache2handler output code).

diff --git a/NEWS b/NEWS
index f8e1e262ca0a66aa35a397f82162027f9a4b50db..8111763e6d53eb5cd7ba9ec5d43b6fcdd0500bb8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jan 2004, Version 4.3.5
+- Changed allow_url_fopen ini option to be PHP_INI_STSTEM. (Sara)
 - Improved the sybase_ct module: (Timm)
   . Added ability to define a message handler not only globally, but also per 
     connection.
@@ -12,6 +13,7 @@ PHP 4                                                                      NEWS
   (Ilia)
 - Fixed bug #27040 (passing an array of form-fields to CURLOPT_POSTFIELDS
   does not work). (Ilia, Jani)
+- Fixed bug #27037 (fixed possible crash in apache2handler output code). (Ilia)
 - Fixed bug #27011 (64bit int/long confusion in preg_match*() functions).
   (Ilia)
 - Fixed bug #26974 (rename() doesn't check the destination file against 
@@ -41,7 +43,6 @@ PHP 4                                                                      NEWS
 - Fixed bug #22403 (PHP crashes when executing a sql procedure without
   parameters). (Timm)
 - Fixed bug #21513 (shutdown functions not executed if timed out). (Zeev)
-- Changed allow_url_fopen ini option to be PHP_INI_STSTEM. (Sara)
 
 12 Jan 2004, Version 4.3.5RC1
 - Synchronized bundled GD library with GD 2.0.17

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index b777071eb037af0173bbe7e94973260218ba52c6..1c09dcb1ff06f89e0e721aa993421e716863a5f9 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -81,7 +81,7 @@ php_apache_sapi_ub_write(const char *str, uint str_length TSRMLS_DC)
        r = ctx->r;
        brigade = ctx->brigade;
        
-       copy_str = apr_pmemdup( r->pool, str, str_length+1);
+       copy_str = apr_pmemdup( r->pool, str, str_length);
        bucket = apr_bucket_pool_create(copy_str, str_length, r->pool, r->connection->bucket_alloc);
                                                 
        APR_BRIGADE_INSERT_TAIL(brigade, bucket);