apcera/nginx-openssl-version — pull request #3 by philpennock (2014-05-13 16:19:37+00:00)
Title: Ensure C string for date parsing is NUL terminated

Fixes #2 (I believe).

`ngx_pstrdup()` does not ensure NUL termination; I apparently believed
that it did, judging by the comment by where it was invoked. Searching,
I found
which fixes the same problem in another module, but I disagree with the
safety of that fix.

Problem not exploitable: the string's contents are copied to a new area,
left not NUL-terminated, then `strptime()` is invoked with a fixed
template, and the return status of `strptime()` is checked, which is why
we got a log message -- we were checking state in a sufficiently
paranoid manner that the API misunderstanding did not escalate.
The memory area is always followed by zeroed content on initial start,
so the issue only becomes apparent when testing reloads enough times to
get (un)lucky with previously returned memory.

@juanman2