Don't walk past the end of the tag in ap_ssi_get_tag_and_value()

Discovered by: Cliff Woolley

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94251 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 2e90e18ade05dc4355e388e8fef1498664a5f94e..c17ca823f611f8e03ca48a52b8175f5a2d4dc3d2 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -957,7 +957,10 @@ static void ap_ssi_get_tag_and_value(include_ctx_t *ctx, char **tag,
     }
     
     *(c-shift_val) = '\0'; /* Overwrites delimiter (term or WS) with NULL. */
-    ctx->curr_tag_pos = ++c;
+    if (*c) {
+        ++c;
+    }
+    ctx->curr_tag_pos = c;
     if (dodecode) {
         decodehtml(*tag_val);
     }