Ensure a string is properly terminated in http_client.c
In HTTP_new_bio(), if the host has a trailing '/' we took a copy of the
hostname but failed to terminate it properly.
@@ -712,11 +712,16 @@ static BIO *HTTP_new_bio(const char *server /* optionally includes ":port" */,
}
host_end = strchr(host, '/');
- if (host_end != NULL && (size_t)(host_end - host) < sizeof(host_name)) {
+ if (host_end != NULL) {
+ size_t host_len = host_end - host;
+
+ if (host_len < sizeof(host_name)) {
/* chop trailing string starting with '/' */
- strncpy(host_name, host, host_end - host + 1);
+ strncpy(host_name, host, host_len);
+ host_name[host_len] = '\0';
host = host_name;
}
+ }
cbio = BIO_new_connect(host /* optionally includes ":port" */);
if (cbio == NULL)
