diff options
| author | christos <christos@NetBSD.org> | 2015-04-19 19:05:19 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2015-04-19 19:05:19 +0000 |
| commit | b289545ee47fe2db562b6b9043ed1e1df8cbb42a (patch) | |
| tree | ef4fac6fc4abe373bbad1f8535bbcaa4b25b8c51 /libexec/httpd | |
| parent | fb92077eba978758c5944e2a47ede45e32b54e3a (diff) | |
Fix deref "command" after "free(file)", from KIYOHARA Takashi
Diffstat (limited to 'libexec/httpd')
| -rw-r--r-- | libexec/httpd/cgi-bozo.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/libexec/httpd/cgi-bozo.c b/libexec/httpd/cgi-bozo.c index 68654dd4d11..09d73cbd02f 100644 --- a/libexec/httpd/cgi-bozo.c +++ b/libexec/httpd/cgi-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: cgi-bozo.c,v 1.25 2014/06/24 07:23:59 shm Exp $ */ +/* $NetBSD: cgi-bozo.c,v 1.26 2015/04/19 19:05:19 christos Exp $ */ /* $eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $ */ @@ -247,7 +247,8 @@ bozo_process_cgi(bozo_httpreq_t *request) char date[40]; bozoheaders_t *headp; const char *type, *clen, *info, *cgihandler; - char *query, *s, *t, *path, *env, *command, *file, *url; + char *query, *s, *t, *path, *env, *file, *url; + char command[MAXPATHLEN]; char **envp, **curenvp, *argv[4]; char *uri; size_t len; @@ -284,7 +285,6 @@ bozo_process_cgi(bozo_httpreq_t *request) path = NULL; envp = NULL; cgihandler = NULL; - command = NULL; info = NULL; len = strlen(url); @@ -309,12 +309,13 @@ bozo_process_cgi(bozo_httpreq_t *request) ix = 0; if (cgihandler) { - command = file + 1; + snprintf(command, sizeof(command), "%s", file + 1); path = bozostrdup(httpd, cgihandler); argv[ix++] = path; /* argv[] = [ path, command, query, NULL ] */ } else { - command = file + CGIBIN_PREFIX_LEN + 1; + snprintf(command, sizeof(command), "%s", + file + CGIBIN_PREFIX_LEN + 1); if ((s = strchr(command, '/')) != NULL) { info = bozostrdup(httpd, s); *s = '\0'; |
