From: Rainer Jung <rjung@apache.org>
Date: Thu, 16 Aug 2012 16:05:21 +0000 (+0000)
Subject: Fix crash in packet dump code of mod_proxy_ajp when
X-Git-Tag: 2.5.0-alpha~6427
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=212cf7938c3aa2a90778ef8e95433c7a82280bf0;p=apache

Fix crash in packet dump code of mod_proxy_ajp when
logging with LogLevel trace7 or trace8.

PR 53730


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1373898 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 4db0da65db..4b97109fd4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) mod_proxy_ajp: Fix crash in packet dump code when logging
+     with LogLevel trace7 or trace8.  PR 53730.  [Rainer Jung]
+
   *) mod_cache: Wrong content type and character set when
      mod_cache serves stale content because of a proxy error. 
      PR 53539.  [Rainer Jung, Ruediger Pluem]
diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
index 638dfee2d8..71bc1dd902 100644
--- a/modules/proxy/ajp_msg.c
+++ b/modules/proxy/ajp_msg.c
@@ -21,9 +21,11 @@ APLOG_USE_MODULE(proxy_ajp);
 #define AJP_MSG_DUMP_BYTES_PER_LINE 16
 /* 2 hex digits plus space plus one char per dumped byte */
 /* plus prefix plus separator plus '\0' */
-#define AJP_MSG_DUMP_LINE_LENGTH    (strlen("XX .") + \
-                                     strlen("XXXX    ") + \
-                                     strlen(" - ") + 1)
+#define AJP_MSG_DUMP_PREFIX_LENGTH  strlen("XXXX    ")
+#define AJP_MSG_DUMP_LINE_LENGTH    ((AJP_MSG_DUMP_BYTES_PER_LINE * \
+                                    strlen("XX .")) + \
+                                    AJP_MSG_DUMP_PREFIX_LENGTH + \
+                                    strlen(" - ") + 1)
 
 static char *hex_table = "0123456789ABCDEF";
 
@@ -70,6 +72,7 @@ apr_status_t ajp_msg_dump(apr_pool_t *pool, ajp_msg_t *msg, char *err,
             return APR_ENOMEM;
         }
         apr_snprintf(current, rl, "%.4lx    ", (unsigned long)i);
+        current += AJP_MSG_DUMP_PREFIX_LENGTH;
         line_len = len - i;
         if (line_len > AJP_MSG_DUMP_BYTES_PER_LINE) {
             line_len = AJP_MSG_DUMP_BYTES_PER_LINE;