summaryrefslogtreecommitdiff
path: root/libexec/httpd
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2015-04-19 19:05:19 +0000
committerchristos <christos@NetBSD.org>2015-04-19 19:05:19 +0000
commitb289545ee47fe2db562b6b9043ed1e1df8cbb42a (patch)
treeef4fac6fc4abe373bbad1f8535bbcaa4b25b8c51 /libexec/httpd
parentfb92077eba978758c5944e2a47ede45e32b54e3a (diff)
Fix deref "command" after "free(file)", from KIYOHARA Takashi
Diffstat (limited to 'libexec/httpd')
-rw-r--r--libexec/httpd/cgi-bozo.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/libexec/httpd/cgi-bozo.c b/libexec/httpd/cgi-bozo.c
index 68654dd4d11..09d73cbd02f 100644
--- a/libexec/httpd/cgi-bozo.c
+++ b/libexec/httpd/cgi-bozo.c
@@ -1,4 +1,4 @@
-/* $NetBSD: cgi-bozo.c,v 1.25 2014/06/24 07:23:59 shm Exp $ */
+/* $NetBSD: cgi-bozo.c,v 1.26 2015/04/19 19:05:19 christos Exp $ */
/* $eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $ */
@@ -247,7 +247,8 @@ bozo_process_cgi(bozo_httpreq_t *request)
char date[40];
bozoheaders_t *headp;
const char *type, *clen, *info, *cgihandler;
- char *query, *s, *t, *path, *env, *command, *file, *url;
+ char *query, *s, *t, *path, *env, *file, *url;
+ char command[MAXPATHLEN];
char **envp, **curenvp, *argv[4];
char *uri;
size_t len;
@@ -284,7 +285,6 @@ bozo_process_cgi(bozo_httpreq_t *request)
path = NULL;
envp = NULL;
cgihandler = NULL;
- command = NULL;
info = NULL;
len = strlen(url);
@@ -309,12 +309,13 @@ bozo_process_cgi(bozo_httpreq_t *request)
ix = 0;
if (cgihandler) {
- command = file + 1;
+ snprintf(command, sizeof(command), "%s", file + 1);
path = bozostrdup(httpd, cgihandler);
argv[ix++] = path;
/* argv[] = [ path, command, query, NULL ] */
} else {
- command = file + CGIBIN_PREFIX_LEN + 1;
+ snprintf(command, sizeof(command), "%s",
+ file + CGIBIN_PREFIX_LEN + 1);
if ((s = strchr(command, '/')) != NULL) {
info = bozostrdup(httpd, s);
*s = '\0';