]> git.tdb.fi Git - libs/net.git/commitdiff
Fix several errors in FormData parsing
authorMikko Rasa <tdb@tdb.fi>
Thu, 26 Sep 2019 23:03:57 +0000 (02:03 +0300)
committerMikko Rasa <tdb@tdb.fi>
Fri, 27 Sep 2019 00:13:06 +0000 (03:13 +0300)
It was terminating early if a part happened to be of certain length.
Extra whitespace was included at the end of parts and there was also an
out-of-bounds memory access.

source/http/formdata.cpp

index 182c5bbbdc7bfc1890cbf6e74380f6ac785902c1..9897bc59b4a1a663ba8d5f124909582e9b75e131 100644 (file)
@@ -53,15 +53,15 @@ void FormData::parse_multipart(const Request &req, const string &boundary)
 
                if(is_boundary)
                {
-                       /* The CRLF preceding the boundary delimiter is treated as part
-                       of the delimiter as per RFC 2046 */
-                       string::size_type part_end = line_start-1;
-                       if(content[part_end-1]=='\r')
-                               --part_end;
-
                        if(part_start>0)
                        {
-                               SubMessage part = SubMessage::parse(content.substr(part_start, line_start-part_start));
+                               /* The CRLF preceding the boundary delimiter is treated as part
+                               of the delimiter as per RFC 2046 */
+                               string::size_type part_end = line_start-1;
+                               if(content[part_end-1]=='\r')
+                                       --part_end;
+
+                               SubMessage part = SubMessage::parse(content.substr(part_start, part_end-part_start));
                                Header content_disposition(part, "Content-Disposition");
                                const Header::Value &cd_value = content_disposition.values.at(0);
                                if(cd_value.value=="form-data")
@@ -72,10 +72,10 @@ void FormData::parse_multipart(const Request &req, const string &boundary)
                        }
 
                        part_start = lf+1;
-               }
 
-               if(!content.compare(line_start+2+boundary.size(), 2, "--"))
-                       break;
+                       if(!content.compare(line_start+2+boundary.size(), 2, "--"))
+                               break;
+               }
 
                line_start = lf+1;
        }