Fixed bug #27037 (fixed possible crash in apache2handler output code).

22 years ago · 7d31f3772c
1 changed files with 1 additions and 1 deletions
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@ -83,7 +83,7 @@ php_apache_sapi_ub_write(const char *str, uint str_length TSRMLS_DC)
 	r = ctx->r;
 	brigade = ctx->brigade;
 	
-	copy_str = apr_pmemdup(r->pool, str, str_length + 1);
+	copy_str = apr_pmemdup(r->pool, str, str_length);
 	bucket = apr_bucket_pool_create(copy_str, str_length, r->pool, r->connection->bucket_alloc);
 						 
 	APR_BRIGADE_INSERT_TAIL(brigade, bucket);