ap_rgetline_core: set the number of bytes read & copied into the caller's

buffer when returning APR_ENOSPC.  This prevents seg faults in
ap_get_mime_headers_core in an error path which handles headers that are too
long.

Submitted by:	Jeff Trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99079 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/protocol.c b/server/protocol.c
index e23ad88ac1b35d3bb86b75d4e6cb5f226fa46529..839279ad629a873369086e4752bc97cf27534c74 100644 (file)
--- a/server/protocol.c
+++ b/server/protocol.c
@@ -290,6 +290,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
 
         /* Would this overrun our buffer?  If so, we'll die. */
         if (n < bytes_handled + len) {
+            *read = bytes_handled;
             return APR_ENOSPC;
         }
 
@@ -390,6 +391,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
             last_char = *s + bytes_handled - 1;
         }
         else {
+            *read = n;
             return APR_ENOSPC;
         }
     }
@@ -519,6 +521,7 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
                 return APR_SUCCESS;
             }
             else {
+                *read = n;
                 return APR_ENOSPC;
             }
         }