Sfoglia il codice sorgente

Return error for incomplete multipart form data (#682)

bel2125 6 anni fa
parent
commit
e2e0f08a6c
1 ha cambiato i file con 8 aggiunte e 0 eliminazioni
  1. 8 0
      src/handle_form.inl

+ 8 - 0
src/handle_form.inl

@@ -873,6 +873,14 @@ mg_handle_form_request(struct mg_connection *conn,
 				/* Set "towrite" to the number of bytes available
 				/* Set "towrite" to the number of bytes available
 				 * in the buffer */
 				 * in the buffer */
 				towrite = (size_t)(buf - hend + buf_fill);
 				towrite = (size_t)(buf - hend + buf_fill);
+
+				if (towrite < bl + 4) {
+					/* Not enough data stored. */
+					/* Incomplete request. */
+					mg_free(boundary);
+					return -1;
+				}
+
 				/* Subtract the boundary length, to deal with
 				/* Subtract the boundary length, to deal with
 				 * cases the boundary is only partially stored
 				 * cases the boundary is only partially stored
 				 * in the buffer. */
 				 * in the buffer. */