From: Antony Dovgal <tony2001@php.net>
Date: Wed, 15 Feb 2006 11:15:32 +0000 (+0000)
Subject: fix memory leak and possible invalid reads
X-Git-Tag: php-5.1.3RC1~105
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=82b6ccbc30b07dc1cfa4830a938e5c8e09256c85;p=php

fix memory leak and possible invalid reads
---

diff --git a/sapi/isapi/php5isapi.c b/sapi/isapi/php5isapi.c
index 97b3a5f51c..315932257a 100644
--- a/sapi/isapi/php5isapi.c
+++ b/sapi/isapi/php5isapi.c
@@ -279,14 +279,18 @@ static int sapi_isapi_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
 			break;
 		default: {
 			const char *sline = SG(sapi_headers).http_status_line;
-			
-			status_buf = emalloc(MAX_STATUS_LENGTH + 1);
+			int sline_len;
 			
 			/* httpd requires that r->status_line is set to the first digit of
 			 * the status-code: */
-			if (sline && strlen(sline) > 12 && strncmp(sline, "HTTP/1.", 7) == 0 && sline[8] == ' ') {
-				status_buf = estrndup(sline + 9, MAX_STATUS_LENGTH);
+			if (sline && ((sline_len = strlen(sline)) > 12) && strncmp(sline, "HTTP/1.", 7) == 0 && sline[8] == ' ') {
+				if ((sline_len - 9) > MAX_STATUS_LENGTH) {
+					status_buf = estrndup(sline + 9, MAX_STATUS_LENGTH);
+				} else {
+					status_buf = estrndup(sline + 9, sline_len - 9);
+				}
 			} else {
+				status_buf = emalloc(MAX_STATUS_LENGTH + 1);
 				snprintf(status_buf, MAX_STATUS_LENGTH, "%d Undescribed", SG(sapi_headers).http_response_code);
 			}
 			header_info.pszStatus = status_buf;