From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 25 May 2006 06:40:47 +0000 (+0000)
Subject: Fixed bug #37496 (FastCGI output buffer overrun)
X-Git-Tag: BEFORE_NEW_OUTPUT_API~95
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c6256d890a5e6228524b2214ad306a78ae5f6224;p=php

Fixed bug #37496 (FastCGI output buffer overrun)
---

diff --git a/sapi/cgi/fastcgi.c b/sapi/cgi/fastcgi.c
index 609c68eac1..1a6cd54ac1 100644
--- a/sapi/cgi/fastcgi.c
+++ b/sapi/cgi/fastcgi.c
@@ -798,6 +798,7 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 	limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf);
 	if (!req->out_hdr) {
 		limit -= sizeof(fcgi_header);
+		if (limit < 0) limit = 0;
 	}
 
 	if (len < limit) {
@@ -810,8 +811,10 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 		if (!req->out_hdr) {
 			open_packet(req, type);
 		}
-		memcpy(req->out_pos, str, limit);
-		req->out_pos += limit;
+		if (limit > 0) {
+			memcpy(req->out_pos, str, limit);
+			req->out_pos += limit;
+		}
 		if (!fcgi_flush(req, 0)) {
 			return -1;
 		}