1 files changed, 81 insertions, 0 deletions
diff --git a/audio/icecast/files/patch-src::http.c b/audio/icecast/files/patch-src::http.c
new file mode 100644
index 000000000000..b2b23087e5c9
--- /dev/null
+++ b/audio/icecast/files/patch-src::http.c
@@ -0,0 +1,81 @@
+--- src/http.c
++++ src/http.c
+@@ -327,7 +327,60 @@
+ }
+ 
+ char * 
+-url_encode (const char *str, char **result_p)
++html_escape (const char *str)
++{
++  const char *p;
++  char *q;
++  char *result;
++  int toescape= 0;
++
++  if (!str) {
++	  xa_debug (1, "WARNING: html_escape() called with NULL string");
++	  return NULL;
++  }
++
++  for (p = str; *p; p++) {
++    if ((unsigned char) (*p) == '&') toescape+=4;
++    if ((unsigned char) (*p) == '"') toescape+=5;
++    if ((unsigned char) (*p) == '<') toescape+=3;
++    if ((unsigned char) (*p) == '>') toescape+=3;
++  }
++  
++  result = (char  *) nmalloc (p - str + toescape + 1);
++
++  for (q = result, p = str; *p; p++) {
++      unsigned char a = *p;
++      if (a == '&') {
++      	  *q++ = '&';
++      	  *q++ = 'a';
++      	  *q++ = 'm';
++      	  *q++ = 'p';
++      	  *q++ = ';';
++      } else if (a == '"') {
++      	  *q++ = '&';
++      	  *q++ = 'q';
++      	  *q++ = 'u';
++      	  *q++ = 'o';
++      	  *q++ = 't';
++      	  *q++ = ';';
++      } else if (a == '<') {
++      	  *q++ = '&';
++      	  *q++ = 'l';
++      	  *q++ = 't';
++      	  *q++ = ';';
++      } else if (a == '>') {
++      	  *q++ = '&';
++      	  *q++ = 'g';
++      	  *q++ = 't';
++      	  *q++ = ';';
++      } else *q++ = *p;
++    }
++  *q++ = 0; 
++  return result;
++}
++
++char * 
++url_encode (const char *str, char** result_p)
+ {
+   const char *p;
+   char *q;
+@@ -345,7 +398,6 @@
+       unacceptable++;
+ 
+   result = (char  *) nmalloc (p - str + unacceptable + unacceptable + 1);
+-
+   *result_p = result;
+ 
+   for (q = result, p = str; *p; p++) 
+@@ -1336,7 +1388,7 @@
+ 	  add_varpair2 (variables, nstrdup (ident), ice_itoa (i));
+ 	  add_varpair2 (variables, ice_cat (ident, ".id"), ice_itoa (travclients->id));
+ 	  add_varpair2 (variables, ice_cat (ident, ".host"), nstrdup (con_host (travclients)));
+-	  add_varpair2 (variables, ice_cat (ident, ".user_agent"), nstrdup (get_user_agent (travclients)));
++	  add_varpair2 (variables, ice_cat (ident, ".user_agent"), nstrdup (html_escape(get_user_agent (travclients))));
+ 	  add_varpair2 (variables, ice_cat (ident, ".writebytes"), ice_utoa (travclients->food.client->write_bytes));
+ 	  add_varpair2 (variables, ice_cat (ident, ".connecttime"), nstrdup (nice_time (get_time() - travclients->connect_time, buf)));
+ 	  endptr = parse_template_file (clicon, NULL, runptr, fd, variables);