From: William A. Rowe Jr <wrowe@apache.org>
Date: Sat, 25 May 2002 20:06:32 +0000 (+0000)
Subject:   Small chance we have an unterminated or single null terminated list.
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f587bdf3cbe1246670f0076f26e0e784f8b84224;p=apache

  Small chance we have an unterminated or single null terminated list.
  Simple workaround to protect our sizing functions from walking past
  the end of allocation.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@95285 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/server/mpm/winnt/registry.c b/server/mpm/winnt/registry.c
index a877e722f0..0fe03b65cc 100644
--- a/server/mpm/winnt/registry.c
+++ b/server/mpm/winnt/registry.c
@@ -258,7 +258,13 @@ apr_status_t ap_registry_get_array(apr_pool_t *p, const char *key, const char *n
     }
     else 
     {
-        pValue = apr_palloc(p, nSize);
+        /* Small possiblity the array is either unterminated 
+         * or single NULL terminated.  Avert.
+         */
+        pValue = apr_palloc(p, nSize + 2);
+        pValue[nSize + 1] = '\0';
+        pValue[nSize] = '\0';
+        
         rv = RegQueryValueEx(hKey, 
 			     name,		/* key name */
 			     NULL,		/* reserved */