Two fixes from Juergen Lock <nox(at)jelal.kn-bremen.de>:
1. varargs: pass size of CRLF as size_t not as int:
--- upnp/src/gena/gena_device.c.orig
+++ upnp/src/gena/gena_device.c
@@ -225,7 +225,7 @@ static UPNP_INLINE int notify_send_and_r
"bbb",
start_msg.buf, start_msg.length,
propertySet, strlen(propertySet),
- "\r\n", 2);
+ "\r\n", sizeof "\r\n" - 1);
if (ret_code) {
membuffer_destroy(&start_msg);
sock_destroy(&info, SD_BOTH);
2. Remove "b" arg here, there is no buffer passed: (this caused a pointer
to be interpreted as a buffer size to be alloc'd/copied, hence the 32 GB.)
--- upnp/src/genlib/net/http/webserver.c.orig
+++ upnp/src/genlib/net/http/webserver.c
@@ -1262,7 +1262,7 @@ static int process_request(
// Content-Range: bytes 222-3333/4000 HTTP_PARTIAL_CONTENT
// Transfer-Encoding: chunked
if (http_MakeMessage(headers, resp_major, resp_minor,
- "R" "TLD" "s" "tcS" "b" "Xc" "sCc",
+ "R" "TLD" "s" "tcS" "Xc" "sCc",
HTTP_OK, // status code
finfo.content_type, // content type
RespInstr, // language info
ed0ebe1588