From 6e4739f918dfb53dff881717a96cfd6b73d06ba8 Mon Sep 17 00:00:00 2001
From: Kornelijus Survila <kornholijo@gmail.com>
Date: Mon, 16 Jan 2017 16:06:03 -0600
Subject: [PATCH] fix(http): Fix heap corruption in http::buffer::grow_zerofill

Fixes #1010
---
 src/http/buf.rs    | 2 +-
 src/http/buffer.rs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/http/buf.rs b/src/http/buf.rs
index 16793949..e458b4c9 100644
--- a/src/http/buf.rs
+++ b/src/http/buf.rs
@@ -141,7 +141,7 @@ impl MemBuf {
 unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) {
     let len = buf.len();
     buf.set_len(len + additional);
-    ::std::ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, buf.len());
+    ::std::ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, additional);
 }
 
 impl fmt::Debug for MemBuf {
diff --git a/src/http/buffer.rs b/src/http/buffer.rs
index 0005a9c2..4d51709b 100644
--- a/src/http/buffer.rs
+++ b/src/http/buffer.rs
@@ -103,5 +103,5 @@ impl Buffer {
 unsafe fn grow_zerofill(buf: &mut Vec<u8>, additional: usize) {
     let len = buf.len();
     buf.set_len(len + additional);
-    ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, buf.len());
+    ptr::write_bytes(buf.as_mut_ptr().offset(len as isize), 0, additional);
 }