MFH: Fixed bug #28692 (\0 in Authenticate header passed via safe_mode).

diff --git a/NEWS b/NEWS
index edd8526bc10f0e614c97fc9ffccbb083efafd1d2..86781b9c03c73953a9c750b0aa89ee2c7fbd392b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, Version 4.3.8
+- Fixed bug #28692 (\0 in Authenticate header passed via safe_mode). (Ilia)
 - Fixed bug #28670 (WWW-Authentication header mangling with PCRE in safe_mode
   adds extra spaces). (Ilia)
 - Fixed bug #28668 (glob() does not work with relative paths on Windows).

diff --git a/main/SAPI.c b/main/SAPI.c
index fae7f1f65d5bf2d2b88d22d7f0ae5fc13282d695..ecbdc3e377d20929a390588879cd98e117f219f6 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -640,7 +640,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
                                                        efree(lower_temp);
                                                }
                                        }
-                                       newlen = sizeof("WWW-Authenticate: ") + result_len;
+                                       newlen = sizeof("WWW-Authenticate: ") - 1  + result_len;
                                        newheader = emalloc(newlen+1);
                                        sprintf(newheader,"WWW-Authenticate: %s", result);
                                        efree(header_line);