Need room for the \0 here to avoid an overflow

diff --git a/main/SAPI.c b/main/SAPI.c
index 3292a7c1c669032914f2e1fe4fd4d7a76130f503..5e6bffc79c2a990a2006507c6c26e8d4686570bd 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -220,7 +220,7 @@ SAPI_API char *sapi_get_default_content_type(TSRMLS_D)
        charset = SG(default_charset) ? SG(default_charset) : SAPI_DEFAULT_CHARSET;
 
        if (strncasecmp(mimetype, "text/", 5) == 0 && *charset) {
-               int len = strlen(mimetype) + sizeof("; charset=") + strlen(charset);
+               int len = strlen(mimetype) + sizeof("; charset=") + strlen(charset)+1;
                content_type = emalloc(len);
                snprintf(content_type, len, "%s; charset=%s", mimetype, charset);
        } else {