SpiderLabs/ModSecurity — pull request #609 by trawick (2013-12-06 00:04:41+00:00)
Title: Fix invalid storage reference in getkey()

Fix invalid storage reference by apr_psprintf() when creating a string from salt[]. salt[] is not
'\0'-terminated, so apr_psprintf() needs to be told the extent of the bytes to read.

It is easy to test old/new code standalone with valgrind; just insert the getkey() function into this template:

#include

#include "apr_general.h"
#include "apr_strings.h"

#include "apr_base64.h"
#include "apr_sha1.h"

<<<>>>

int main(void)
{
apr_pool_t *p;

apr_initialize();
apr_pool_create(&p, NULL);

printf("%s\n", getkey(p));
return 0;
}