illegal alloca in handleindexcgi(...)

Mark-Andre Hopf <[email protected]> Fri, 28 Jan 2005 13:25:41 +0100
Newsgroups gmane.comp.web.fnord
Organization Innominate Security Technologies AG
Message-ID <[email protected]>
The function 'handleindexcgi' allocates a string with

  test=alloca(ul+1);

but returns it with

  url=test;

Mark

Index: httpd.c
===================================================================
RCS file: /cvs/httpd/httpd.c,v
retrieving revision 1.84
diff -u -r1.84 httpd.c
--- httpd.c	2 Mar 2004 21:31:18 -0000	1.84
+++ httpd.c	28 Jan 2005 12:20:34 -0000
@@ -1039,7 +1039,7 @@
   while (testurl[0]=='/') ++testurl,--ol;
   ul=str_len(testurl);
   if (str_diff(testurl+ol,"index.html")) return 0; /* no request for index.html */
-  test=alloca(ul+1);
+  test=malloc(ul+1);
   ++test;
   ul-=4;
   byte_copy(test,ul,testurl);

-- 
[email protected]
dipl.-inf.                        Innominate Security Technologies AG
senior software engineer                            enabling security
tel: +49.30.6392-3300                      http://www.innominate.com/