Fixed bug #27037 (fixed possible crash in apache2handler output code).

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 756be1c251735fd078aaeb00c21229f7771abfe1..f6bc71f61b23a17a4b70a208cf1d2fbad5c564dd 100644 (file)
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -83,7 +83,7 @@ php_apache_sapi_ub_write(const char *str, uint str_length TSRMLS_DC)
        r = ctx->r;
        brigade = ctx->brigade;
        
-       copy_str = apr_pmemdup(r->pool, str, str_length + 1);
+       copy_str = apr_pmemdup(r->pool, str, str_length);
        bucket = apr_bucket_pool_create(copy_str, str_length, r->pool, r->connection->bucket_alloc);
                                                 
        APR_BRIGADE_INSERT_TAIL(brigade, bucket);