--- modules/http/http_filters.c +++ modules/http/http_filters.c @@ -802,12 +802,21 @@ { char *end; - if (r->status_line - && (strlen(r->status_line) <= 4 + if (r->status_line) { + int len = strlen(r->status_line); + if (len < 3 || apr_strtoi64(r->status_line, &end, 10) != r->status - || *end != ' ' - || (end - 3) != r->status_line)) { - r->status_line = NULL; + || (end - 3) != r->status_line + || (len >= 4 && ! apr_isspace(r->status_line[3]))) { + r->status_line = NULL; + } + /* Since we passed the above check, we know that length three + * is equivalent to only a 3 digit numeric http status. + * RFC2616 mandates a trailing space, let's add it. + */ + else if (len == 3) { + r->status_line = apr_pstrcat(r->pool, r->status_line, " "); + } } }