From c6256d890a5e6228524b2214ad306a78ae5f6224 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Thu, 25 May 2006 06:40:47 +0000 Subject: [PATCH] Fixed bug #37496 (FastCGI output buffer overrun) --- sapi/cgi/fastcgi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sapi/cgi/fastcgi.c b/sapi/cgi/fastcgi.c index 609c68eac1..1a6cd54ac1 100644 --- a/sapi/cgi/fastcgi.c +++ b/sapi/cgi/fastcgi.c @@ -798,6 +798,7 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf); if (!req->out_hdr) { limit -= sizeof(fcgi_header); + if (limit < 0) limit = 0; } if (len < limit) { @@ -810,8 +811,10 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l if (!req->out_hdr) { open_packet(req, type); } - memcpy(req->out_pos, str, limit); - req->out_pos += limit; + if (limit > 0) { + memcpy(req->out_pos, str, limit); + req->out_pos += limit; + } if (!fcgi_flush(req, 0)) { return -1; } -- 2.50.1