From: Graham Leggett <minfrin@apache.org>
Date: Mon, 10 Jun 2013 14:28:08 +0000 (+0000)
Subject: proxy_util: NULL terminate the right buffer in 'send_http_connect'
X-Git-Tag: 2.4.5~145
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=17851377db8eb9512981445ce6585d6c1b086f4b;p=apache

proxy_util: NULL terminate the right buffer in 'send_http_connect'

trunk patch: http://svn.apache.org/r1490994
Submitted by: jailletc36
Reviewed by: covener, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1491466 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index b4352fc8e9..90e016f8c6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 
 Changes with Apache 2.4.5
 
+  *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.
+     [Christophe Jaillet]
+
   *) mod_remoteip: close file in error path. [Christophe Jaillet]
 
   *) mod_lua: Sync 2.4 branch with trunk. This includes (but is not limited to)
diff --git a/STATUS b/STATUS
index fea2ee1dd9..01aa549a60 100644
--- a/STATUS
+++ b/STATUS
@@ -100,11 +100,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
       2.4.x patch: trunk patch works modulo CHANGES and mmn bump
       +1: minfrin, jim, sf
 
-    * proxy_util: NULL terminate the right buffer in 'send_http_connect'
-      trunk patch: http://svn.apache.org/r1490994
-      2.4.x patch: trunk patch works
-      +1: jailletc36, covener, minfrin
-
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
index 5ab5d9144a..4f0a9a432e 100644
--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
@@ -2316,7 +2316,7 @@ static apr_status_t send_http_connect(proxy_conn_rec *backend,
         nbytes = sizeof(drain_buffer) - 1;
         while (status == APR_SUCCESS && nbytes) {
             status = apr_socket_recv(backend->sock, drain_buffer, &nbytes);
-            buffer[nbytes] = '\0';
+            drain_buffer[nbytes] = '\0';
             nbytes = sizeof(drain_buffer) - 1;
             if (strstr(drain_buffer, "\r\n\r\n") != NULL) {
                 break;