Fixed check for buffer overrun in ap_rgetline()

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92324 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/protocol.c b/server/protocol.c
index 9400901425070c106d2c80dcf9fd8b48eb607c71..f71d7dfb677372d29c0bbb6ca2e3578790795f1b 100644 (file)
--- a/server/protocol.c
+++ b/server/protocol.c
@@ -257,7 +257,7 @@ AP_DECLARE(int) ap_rgetline(char **s, int n, request_rec *r, int fold)
             AP_DEBUG_ASSERT(!APR_BRIGADE_EMPTY(req_cfg->bb));
             break;
         }
-        if (length - 1 < n) {
+        if (total + length - 1 < n) {
             if (!*s) {
                 *s = apr_palloc(r->pool, length + 2); /* +2 for LF, null */
             }