Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/libexec/httpd/cgi-bozo.c,v
rcsdiff: /ftp/cvs/cvsroot/src/libexec/httpd/cgi-bozo.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.25.2.2.2.7
retrieving revision 1.25.2.2.2.8
diff -u -p -r1.25.2.2.2.7 -r1.25.2.2.2.8
--- src/libexec/httpd/cgi-bozo.c	2018/11/28 19:57:50	1.25.2.2.2.7
+++ src/libexec/httpd/cgi-bozo.c	2019/06/15 15:57:32	1.25.2.2.2.8
@@ -1,9 +1,9 @@
-/*	$NetBSD: cgi-bozo.c,v 1.25.2.2.2.7 2018/11/28 19:57:50 martin Exp $	*/
+/*	$NetBSD: cgi-bozo.c,v 1.25.2.2.2.8 2019/06/15 15:57:32 martin Exp $	*/
 
 /*	$eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $	*/
 
 /*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -241,10 +241,10 @@ parse_search_string(bozo_httpreq_t *requ
  
 	args[0] = str;
 	args[*args_len] = NULL;
-	for (s = str, i = 0; (s = strchr(s, '+')) != NULL;) {
+	for (s = str, i = 1; (s = strchr(s, '+')) != NULL; i++) {
 		*s = '\0';
 		s++;
-		args[i++] = s;
+		args[i] = s;
 	}
 
 	/*
@@ -333,8 +333,7 @@ parse_search_string(bozo_httpreq_t *requ
 
 parse_err:
 
-	free (str);
-	free (*args);
+	free(str);
 	free(args);
 	*args_len = 0;
 
@@ -494,6 +493,7 @@ bozo_process_cgi(bozo_httpreq_t *request
 	    (clen && *clen ? 1 : 0) +
 	    (request->hr_remotehost && *request->hr_remotehost ? 1 : 0) +
 	    (request->hr_remoteaddr && *request->hr_remoteaddr ? 1 : 0) +
+	    (cgihandler ? 1 : 0) +
 	    bozo_auth_cgi_count(request) +
 	    (request->hr_serverport && *request->hr_serverport ? 1 : 0);
 
@@ -610,9 +610,12 @@ bozo_process_cgi(bozo_httpreq_t *request
 		closelog();
 		bozo_daemon_closefds(httpd);
 
-		if (-1 == execve(path, argv, envp))
+		if (-1 == execve(path, argv, envp)) {
+			bozo_http_error(httpd, 404, request,
+				"Cannot execute CGI");
 			bozoerr(httpd, 1, "child exec failed: %s: %s",
 			      path, strerror(errno));
+		}
 		/* NOT REACHED */
 		bozoerr(httpd, 1, "child execve returned?!");
 	}