Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57662
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain nebm.ist.utl.pt from 193.136.128.22 cause and error)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "John LeSueur" <john.lesueur@gmail.com>
Cc: internals@lists.php.net
References: <D5EC076D-8518-4CDC-913F-5A3F3BB97367@sektioneins.de>
 <op.v83qfyebidpuyk@slws007.slhq.int> <op.v83vw0bcidpuyk@slws007.slhq.int>
 <CAGsnKxbx+Mip76tMc_a9==DRhSVSgVDh-U5WftPYvwKq25XMLQ@mail.gmail.com>
Date: Fri, 03 Feb 2012 15:16:31 +0100
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Organization: =?utf-8?Q?N=C3=BAcleo_de_Eng=2E_Biom=C3=A9di?=
 =?utf-8?Q?ca_do_I=2ES=2ET=2E?=
Message-ID: <op.v83wltr7idpuyk@slws007.slhq.int>
In-Reply-To: <CAGsnKxbx+Mip76tMc_a9==DRhSVSgVDh-U5WftPYvwKq25XMLQ@mail.gmail.com>
User-Agent: Opera Mail/11.61 (Win32)
Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP
From: glopes@nebm.ist.utl.pt ("Gustavo Lopes")

On Fri, 03 Feb 2012 15:13:56 +0100, John LeSueur <john.lesueur@gmail.com>  
wrote:

> I could be wrong, but doesn't:
>  (header_line[i+1] != ' ' && header_line[i+1] != '\t')
> access an element past the end of the header_line array on the last
> iteration of the for loop? shouldn't the for loop go until  
> header_line_len
> - 1?
>

No in this case because header_line_len is the length not including the  
terminator and estrndup guarantees a null terminated string.

Thanks

-- 
Gustavo Lopes