http-backend: Fix access beyond end of string.

Found with valgrind while looking for Content-Length corruption in smart http. Signed-off-by: Tarmigan Casebolt <tarmigan+git@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Tarmigan Casebolt committed Nov 14, 2009 at 13:10 UTC 48aec1b1f14578ac7560c8be40890ebf52c91d78

1 file changed +4 -3

http-backend.c

+4 -3

@@ -615,7 +615,7 @@ int main(int argc, char **argv)

615 if (regcomp(&re, c->pattern, REG_EXTENDED))

616 die("Bogus regex in service table: %s", c->pattern);

617 if (!regexec(&re, dir, 1, out, 0)) {

618 - size_t n = out[0].rm_eo - out[0].rm_so;

618 + size_t n;

619

620 if (strcmp(method, c->method)) {

621 const char *proto = getenv("SERVER_PROTOCOL");

@@ -629,9 +629,10 @@ int main(int argc, char **argv)

629 }

630

631 cmd = c;

632 + n = out[0].rm_eo - out[0].rm_so;

633 cmd_arg = xmalloc(n);

633 - strncpy(cmd_arg, dir + out[0].rm_so + 1, n);

634 - cmd_arg[n] = '\0';

634 + memcpy(cmd_arg, dir + out[0].rm_so + 1, n-1);

635 + cmd_arg[n-1] = '\0';

636 dir[out[0].rm_so] = 0;

637 break;

638 }