Mercurial > hg > nginx-vendor-current

diff src/core/ngx_string.c @ 364:a39aab45a53f NGINX_0_6_26

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
nginx 0.6.26 *) Bugfix: the "proxy_store" and "fastcgi_store" directives did not check a response length. *) Bugfix: a segmentation fault occurred in worker process, if big value was used in a "expires" directive. Thanks to Joaquin Cuenca Abela. *) Bugfix: nginx incorrectly detected cache line size on Pentium 4. Thanks to Gena Makhomed. *) Bugfix: in proxied or FastCGI subrequests a client original method was used instead of the GET method. *) Bugfix: socket leak in HTTPS mode if deferred accept was used. Thanks to Ben Maurer. *) Bugfix: nginx issued the bogus error message "SSL_shutdown() failed (SSL: )"; bug appeared in 0.6.23. *) Bugfix: in HTTPS mode requests might fail with the "bad write retry" error; bug appeared in 0.6.23.
author Igor Sysoev <http://sysoev.ru>
date Mon, 11 Feb 2008 00:00:00 +0300
parents 9121a0a91f47
children 6639b93e81b2
line wrap: on
line diff
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -147,7 +147,7 @@ ngx_vsnprintf(u_char *buf, size_t max, c
             sign = 1;
             hexadecimal = 0;
             max_width = 0;
-            slen = 0;
+            slen = (size_t) -1;
 
             p = temp + NGX_INT64_LEN;
 
@@ -182,7 +182,7 @@ ngx_vsnprintf(u_char *buf, size_t max, c
                     continue;
 
                 case '*':
-                    slen = va_arg(args, u_int);
+                    slen = va_arg(args, size_t);
                     fmt++;
                     continue;
 
@@ -221,13 +221,15 @@ ngx_vsnprintf(u_char *buf, size_t max, c
             case 's':
                 p = va_arg(args, u_char *);
 
-                if (slen == 0) {
+                if (slen == (size_t) -1) {
                     while (*p && buf < last) {
                         *buf++ = *p++;
                     }
 
                 } else {
-                    buf = ngx_cpymem(buf, p, slen);
+                    len = (buf + slen < last) ? slen : (size_t) (last - buf);
+
+                    buf = ngx_cpymem(buf, p, len);
                 }
 
                 fmt++;