From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 30 May 2012 15:30:07 +0000 (+0000)
Subject: uhttpd: fix wrongly applied sizeof() leading to writing beyound end of buffer and... 
X-Git-Tag: reboot~13734
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=5aefe3b277662416ea1a6e97292d4b360ef74c41;p=oweals%2Fopenwrt.git

uhttpd: fix wrongly applied sizeof() leading to writing beyound end of buffer and subsequent data corruption (#11557)

SVN-Revision: 32005
---

diff --git a/package/uhttpd/Makefile b/package/uhttpd/Makefile
index f30d6cabd1..13da14dfe9 100644
--- a/package/uhttpd/Makefile
+++ b/package/uhttpd/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uhttpd
-PKG_RELEASE:=33
+PKG_RELEASE:=34
 
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 PKG_CONFIG_DEPENDS := \
diff --git a/package/uhttpd/src/uhttpd.c b/package/uhttpd/src/uhttpd.c
index e10f5dc9e1..d5d5dfb982 100644
--- a/package/uhttpd/src/uhttpd.c
+++ b/package/uhttpd/src/uhttpd.c
@@ -385,10 +385,10 @@ static struct http_request * uh_http_header_recv(struct client *cl)
 	char *bufptr = cl->httpbuf.buf;
 	char *idxptr = NULL;
 
-	ssize_t blen = sizeof(cl->httpbuf)-1;
+	ssize_t blen = sizeof(cl->httpbuf.buf)-1;
 	ssize_t rlen = 0;
 
-	memset(bufptr, 0, sizeof(cl->httpbuf));
+	memset(bufptr, 0, sizeof(cl->httpbuf.buf));
 
 	while (blen > 0)
 	{