fixed: bufferoverflow in sapi_add_header_ex triggerable by header("WWW-Authenticate...

diff --git a/main/SAPI.c b/main/SAPI.c
index 7b226f112b01536fc32dbfe3b99ddcb5a38fded0..396927685e652fba01aeb33c0bf1fed80c35608a 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -504,6 +504,7 @@ SAPI_API int sapi_add_header_ex(char *header_line, uint header_line_len, zend_bo
                                                                efree(result);
                                                                conv_len = sprintf(conv_temp," realm=\"%ld\"",myuid);           
                                                                result = emalloc(ptr_len+conv_len+1);
+                                                               result_len = ptr_len+conv_len;
                                                                memcpy(result, ptr, ptr_len);   
                                                                memcpy(result+ptr_len, conv_temp, conv_len);
                                                                *(result+ptr_len+conv_len) = '\0';