浏览代码

Merge pull request #559 from newsoft/master

Fix truncation check in (deprecated) mg_upload_field_found() function.
bel2125 7 年之前
父节点
当前提交
e58119f3c2
共有 2 个文件被更改,包括 13 次插入1 次删除
  1. 1 1
      src/civetweb.c
  2. 12 0
      src/handle_form.inl

+ 1 - 1
src/civetweb.c

@@ -12072,7 +12072,7 @@ mg_upload_field_found(const char *key,
 	            "%s/%s",
 	            fud->destination_dir,
 	            filename);
-	if (!truncated) {
+	if (truncated) {
 		mg_cry(fud->conn, "%s: File path too long", __func__);
 		return FORM_FIELD_STORAGE_ABORT;
 	}

+ 12 - 0
src/handle_form.inl

@@ -473,6 +473,10 @@ mg_handle_form_request(struct mg_connection *conn,
 						r = mg_read(conn, buf + (size_t)buf_fill, to_read);
 						if (r < 0) {
 							/* read error */
+							if (fstore.access.fp) {
+								mg_fclose(&fstore.access);
+								remove_bad_file(conn, path);
+							}
 							return -1;
 						}
 						if (r != (int)to_read) {
@@ -869,6 +873,10 @@ mg_handle_form_request(struct mg_connection *conn,
 				            sizeof(buf) - 1 - (size_t)buf_fill);
 				if (r < 0) {
 					/* read error */
+					if (fstore.access.fp) {
+						mg_fclose(&fstore.access);
+						remove_bad_file(conn, path);
+					}
 					mg_free(boundary);
 					return -1;
 				}
@@ -876,6 +884,10 @@ mg_handle_form_request(struct mg_connection *conn,
 				buf[buf_fill] = 0;
 				if (buf_fill < 1) {
 					/* No data */
+					if (fstore.access.fp) {
+						mg_fclose(&fstore.access);
+						remove_bad_file(conn, path);
+					}
 					mg_free(boundary);
 					return -1;
 				}