Small chance we have an unterminated or single null terminated list.

  Simple workaround to protect our sizing functions from walking past
  the end of allocation.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95285 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/mpm/winnt/registry.c b/server/mpm/winnt/registry.c
index a877e722f0902becba424c19b4001e3f2bd4dbf1..0fe03b65ccc3743826ce5b3d73c82b65ac6ecb74 100644 (file)
--- a/server/mpm/winnt/registry.c
+++ b/server/mpm/winnt/registry.c
@@ -258,7 +258,13 @@ apr_status_t ap_registry_get_array(apr_pool_t *p, const char *key, const char *n
     }
     else 
     {
-        pValue = apr_palloc(p, nSize);
+        /* Small possiblity the array is either unterminated 
+         * or single NULL terminated.  Avert.
+         */
+        pValue = apr_palloc(p, nSize + 2);
+        pValue[nSize + 1] = '\0';
+        pValue[nSize] = '\0';
+        
         rv = RegQueryValueEx(hKey, 
                             name,              /* key name */
                             NULL,              /* reserved */