From 5aefe3b277662416ea1a6e97292d4b360ef74c41 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 30 May 2012 15:30:07 +0000
Subject: uhttpd: fix wrongly applied sizeof() leading to writing beyound end
of buffer and subsequent data corruption (#11557)
SVN-Revision: 32005
---
package/uhttpd/Makefile | 2 +-
package/uhttpd/src/uhttpd.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
(limited to 'package/uhttpd')
diff --git a/package/uhttpd/Makefile b/package/uhttpd/Makefile
index f30d6cabd1..13da14dfe9 100644
--- a/package/uhttpd/Makefile
+++ b/package/uhttpd/Makefile
@@ -8,7 +8,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=uhttpd
-PKG_RELEASE:=33
+PKG_RELEASE:=34
PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
PKG_CONFIG_DEPENDS := \
diff --git a/package/uhttpd/src/uhttpd.c b/package/uhttpd/src/uhttpd.c
index e10f5dc9e1..d5d5dfb982 100644
--- a/package/uhttpd/src/uhttpd.c
+++ b/package/uhttpd/src/uhttpd.c
@@ -385,10 +385,10 @@ static struct http_request * uh_http_header_recv(struct client *cl)
char *bufptr = cl->httpbuf.buf;
char *idxptr = NULL;
- ssize_t blen = sizeof(cl->httpbuf)-1;
+ ssize_t blen = sizeof(cl->httpbuf.buf)-1;
ssize_t rlen = 0;
- memset(bufptr, 0, sizeof(cl->httpbuf));
+ memset(bufptr, 0, sizeof(cl->httpbuf.buf));
while (blen > 0)
{
--
cgit v1.2.3