Merge pull request #3545 from airween/v2/acmppmfix

fix: heap buffer overflow in acmp pm

Author: airween

apache2/acmp.c

@@ -514,17 +514,20 @@ apr_status_t acmp_add_pattern(ACMP *parser, const char *pattern,
             child->pattern = "";
             child->letter = letter;
             child->depth = i;
-            child->text = apr_pcalloc(parser->pool, strlen(pattern) + 2);
+            child->text = apr_pcalloc(parser->pool, i + 2);
             /* ENH: Check alloc succeded */
-            for (j = 0; j <= i; j++) child->text[j] = pattern[j];
+            for (j = 0; j <= i; j++) {
+                child->text[j] = pattern[j];
+            }
         }
         if (i == length - 1) {
             if (child->is_last == 0) {
                 parser->dict_count++;
                 child->is_last = 1;
-                child->pattern = apr_pcalloc(parser->pool, strlen(pattern) + 2);
+                child->pattern = apr_pcalloc(parser->pool, length + 1);
                 /* ENH: Check alloc succeded */
-                strcpy(child->pattern, pattern);
+                memcpy(child->pattern, pattern, length);
+                child->pattern[length] = '\0';
             }
             child->callback = callback;
             child->callback_data = data;