SpiderLabs/ModSecurity — pull request #13 by hideaki (2012-12-08 01:07:31+00:00)
Title: fixed bugs in cpf_verify

This is fix for validation logic for CPF.

1. check for var_len is wrong. original code would read one extra byte from the buffer if the string is not null terminated.
2. check for strlen(s_cpf) is unnecessary and unsafe.
It is unnecessary because checking i does the same thing, and it is unsafe because s_cpf is not guaranteed to be zeroed.
3. check for i is wrong. It should be compared with cpf_len instead of cpf_len-1. In the original code, valid CPFs were deemed as invalid because of this.