cvs: php4 /sapi/cgi cgi_main.c

edink Fri Nov 22 10:47:39 2002 EDT Modified files: /php4/sapi/cgi cgi_main.c Log: Avoid possible buffer overflow. Index: php4/sapi/cgi/cgi_main.c diff -u php4/sapi/cgi/cgi_main.c:1.195 php4/sapi/cgi/cgi_main.c:1.196 --- php4/sapi/cgi/cgi_main.c:1.195 Fri Nov 22 08:55:27 2002 +++ php4/sapi/cgi/cgi_main.c Fri Nov 22 10:47:39 2002 @@ -234,10 +234,11 @@ } } +#define SAPI_CGI_MAX_HEADER_LENGTH 1024 static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC) { - char buf[1024]; + char buf[SAPI_CGI_MAX_HEADER_LENGTH]; sapi_header_struct *h; zend_llist_position pos; long rfc2616_headers = 0; @@ -255,7 +256,13 @@ int len; if (rfc2616_headers) { - len = sprintf(buf, "%s\r\n", SG(sapi_headers).http_status_line); + len = snprintf(buf, SAPI_CGI_MAX_HEADER_LENGTH, + "%s\r\n", SG(sapi_headers).http_status_line); + + if (len > SAPI_CGI_MAX_HEADER_LENGTH) { + len = SAPI_CGI_MAX_HEADER_LENGTH; + } + } else { len = sprintf(buf, "Status: %d\r\n", SG(sapi_headers).http_response_code); }