diff options
| author | Michael R Sweet <michael.r.sweet@gmail.com> | 2019-04-18 07:52:54 -0400 |
|---|---|---|
| committer | Michael R Sweet <michael.r.sweet@gmail.com> | 2019-04-18 07:52:54 -0400 |
| commit | 9a51a8159fe4231a31e9a20084ae3ce3f4e8e366 (patch) | |
| tree | f5b04b47355eb711506156dd7f7c531a3ec69ee6 /cups | |
| parent | ef6de4e15d016ef403075ad4c12f4e2a2f865cc2 (diff) | |
| download | cups-9a51a8159fe4231a31e9a20084ae3ce3f4e8e366.tar.gz | |
Fix a memory reallocation bug in HTTP header value expansion
(rdar://problem/50000749)
Diffstat (limited to 'cups')
| -rw-r--r-- | cups/http.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/cups/http.c b/cups/http.c index df9b7bdd6..ff8f6918f 100644 --- a/cups/http.c +++ b/cups/http.c @@ -3644,7 +3644,15 @@ http_add_field(http_t *http, /* I - HTTP connection */ char *combined; /* New value string */ - if ((combined = realloc(http->fields[field], total + 1)) != NULL) + if (http->fields[field] == http->_fields[field]) + { + if ((combined = malloc(total + 1)) != NULL) + { + http->fields[field] = combined; + snprintf(combined, total + 1, "%s, %s", http->_fields[field], value); + } + } + else if ((combined = realloc(http->fields[field], total + 1)) != NULL) { http->fields[field] = combined; strlcat(combined, ", ", total + 1); |