mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-29 19:24:29 +03:00
Bugfix: missing string terminator while mounting the charset (nginx)
The charset in headers is mounted using ngx_snprintf which does not place the string terminator. This patch adds the terminator at the end of the string. The size was correctly allocated, just missing the terminator. This bug was report at: - https://www.modsecurity.org/tracker/browse/MODSEC-420 - https://github.com/SpiderLabs/ModSecurity/issues/142 Both reports cames with patch, first by Veli Pekka Jutila and second by wellumies.
This commit is contained in:
@@ -615,7 +615,7 @@ ngx_http_modsecurity_load_headers_out(ngx_http_request_t *r)
|
||||
}
|
||||
|
||||
ngx_snprintf(content_type, content_type_len,
|
||||
"%V; charset=%V",
|
||||
"%V; charset=%V\0",
|
||||
&r->headers_out.content_type,
|
||||
&r->headers_out.charset);
|
||||
|
||||
|
Reference in New Issue
Block a user