Potential fixes. Patch up the fact that users often expect argv[]s

  to be NULL terminated, even though argc should clearly limit the array.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95525 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/mpm/winnt/service.c b/server/mpm/winnt/service.c
index d6f3b600730e05ade1f31797a1a3ad28d5234b8f..93cfe5da29908aab022f3a622cc0479472187b25 100644 (file)
--- a/server/mpm/winnt/service.c
+++ b/server/mpm/winnt/service.c
@@ -1058,11 +1058,12 @@ apr_status_t mpm_service_start(apr_pool_t *ptemp, int argc,
         }
         
         argc += 1;
-        start_argv = malloc(argc * sizeof(const char **));
+        start_argv = malloc((argc + 1) * sizeof(const char **));
         start_argv[0] = mpm_service_name;
         if (argc > 1)
             memcpy(start_argv + 1, argv, (argc - 1) * sizeof(const char **));
-        
+        start_argv[argc] = NULL;
+
         rv = APR_EINIT;
         if (StartService(schService, argc, start_argv)
             && signal_service_transition(schService, 0, /* test only */