|  | @@ -545,10 +545,17 @@ mg_handle_form_request(struct mg_connection *conn,
 | 
											
												
													
														|  |  		if (boundary[0] == '"') {
 |  |  		if (boundary[0] == '"') {
 | 
											
												
													
														|  |  			/* RFC 2046 permits the boundary string to be quoted. */
 |  |  			/* RFC 2046 permits the boundary string to be quoted. */
 | 
											
												
													
														|  |  			hbuf = strchr(boundary + 1, '"');
 |  |  			hbuf = strchr(boundary + 1, '"');
 | 
											
												
													
														|  | 
 |  | +			if (!hbuf) {
 | 
											
												
													
														|  | 
 |  | +				/* Malformed request */
 | 
											
												
													
														|  | 
 |  | +				return -1;
 | 
											
												
													
														|  | 
 |  | +			}
 | 
											
												
													
														|  |  			if (*hbuf) {
 |  |  			if (*hbuf) {
 | 
											
												
													
														|  |  				*hbuf = 0;
 |  |  				*hbuf = 0;
 | 
											
												
													
														|  |  				boundary++;
 |  |  				boundary++;
 | 
											
												
													
														|  |  				bl = strlen(boundary);
 |  |  				bl = strlen(boundary);
 | 
											
												
													
														|  | 
 |  | +			} else {
 | 
											
												
													
														|  | 
 |  | +				/* Malformed request */
 | 
											
												
													
														|  | 
 |  | +				return -1;
 | 
											
												
													
														|  |  			}
 |  |  			}
 | 
											
												
													
														|  |  		}
 |  |  		}
 | 
											
												
													
														|  |  
 |  |  
 |