Check length of memcmp

civetweb · Jun 16, 2018 · 8fd069f · 8fd069f
1 parent 9fc1e25
commit 8fd069f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/civetweb.c b/src/civetweb.c
@@ -11611,10 +11611,10 @@ send_ssi_file(struct mg_connection *conn,
 					/* Handle SSI tag */
 					buf[len] = 0;
 
-					if (!memcmp(buf + 5, "include", 7)) {
+					if ((len > 12) && !memcmp(buf + 5, "include", 7)) {
 						do_ssi_include(conn, path, buf + 12, include_level + 1);
 #if !defined(NO_POPEN)
-					} else if (!memcmp(buf + 5, "exec", 4)) {
+					} else if ((len > 9) && !memcmp(buf + 5, "exec", 4)) {
 						do_ssi_exec(conn, buf + 9);
 #endif /* !NO_POPEN */
 					} else {