newtype has a length of newlen+1, 'len' refers to the length of *mimetype

here.

diff --git a/main/SAPI.c b/main/SAPI.c
index 60b886fd0abd0f96a10b1ff5ea6e8e7ab6e8a9e6..95adcc9e68c12d51d1fe0e07add6fc34f11d4678 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -247,8 +247,8 @@ SAPI_API size_t sapi_apply_default_charset(char **mimetype, size_t len SLS_DC)
        if (*charset && strncmp(*mimetype, "text/", 5) == 0 && strstr(*mimetype, "charset=") == NULL) {
                newlen = len + (sizeof(";charset=")-1) + strlen(charset);
                newtype = emalloc(newlen + 1);
-               strlcpy(newtype, *mimetype, len);
-               strlcat(newtype, ";charset=", len);
+               PHP_STRLCPY(newtype, *mimetype, newlen + 1, len);
+               strlcat(newtype, ";charset=", newlen + 1);
                if (*mimetype != NULL) {
                        efree(*mimetype);
                }