From 494845b1604ead6518fad07294e2879ba404bd03 Mon Sep 17 00:00:00 2001
From: Daniel Patterson <daniel@mapbox.com>
Date: Mon, 13 Jun 2016 12:59:42 -0700
Subject: [PATCH] Copy data to beginning of buffer, not end. (#2542)

Copy data to beginning of buffer, not end.
---
 CHANGELOG.md                   | 4 ++++
 src/server/request_handler.cpp | 5 ++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5671e406f..3255abe34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# 5.2.2
+  - Bugfix
+    - buffer overrun in tile plugin response handling
+
 # 5.2.0
   Changes form 5.2.0 RC2
    - Bugfixes:
diff --git a/src/server/request_handler.cpp b/src/server/request_handler.cpp
index 7845125a4..7e49b5e85 100644
--- a/src/server/request_handler.cpp
+++ b/src/server/request_handler.cpp
@@ -105,11 +105,10 @@ void RequestHandler::HandleRequest(const http::request &current_request, http::r
         else
         {
             BOOST_ASSERT(result.is<std::string>());
-            current_reply.content.resize(current_reply.content.size() +
-                                         result.get<std::string>().size());
+            current_reply.content.resize(result.get<std::string>().size());
             std::copy(result.get<std::string>().cbegin(),
                       result.get<std::string>().cend(),
-                      current_reply.content.end());
+                      current_reply.content.begin());
 
             current_reply.headers.emplace_back("Content-Type", "application/x-protobuf");
         }