|
@@ -640,6 +640,11 @@ mg_handle_form_request(struct mg_connection *conn,
|
|
|
nbeg = strstr(nbeg + 1, "name=\"");
|
|
|
}
|
|
|
|
|
|
+ /* This line is not required, but otherwise some compilers
|
|
|
+ * generate spurious warnings. */
|
|
|
+ nend = nbeg;
|
|
|
+
|
|
|
+ /* If name=" is found, search for the closing " */
|
|
|
if (nbeg) {
|
|
|
nbeg += 6;
|
|
|
nend = strchr(nbeg, '\"');
|
|
@@ -677,6 +682,12 @@ mg_handle_form_request(struct mg_connection *conn,
|
|
|
/* It could be somethingfilename= instead of filename= */
|
|
|
fbeg = strstr(fbeg + 1, "filename=\"");
|
|
|
}
|
|
|
+
|
|
|
+ /* This line is not required, but otherwise some compilers
|
|
|
+ * generate spurious warnings. */
|
|
|
+ fend = fbeg;
|
|
|
+
|
|
|
+ /* If filename=" is found, search for the closing " */
|
|
|
if (fbeg) {
|
|
|
fbeg += 10;
|
|
|
fend = strchr(fbeg, '\"');
|
|
@@ -710,9 +721,7 @@ mg_handle_form_request(struct mg_connection *conn,
|
|
|
* a request like name=filename=xyz. Check if name and
|
|
|
* filename do not overlap. */
|
|
|
if (!(((ptrdiff_t)fbeg > (ptrdiff_t)nend)
|
|
|
- || ((ptrdiff_t)nbeg > (ptrdiff_t)fend)
|
|
|
-
|
|
|
- )) {
|
|
|
+ || ((ptrdiff_t)nbeg > (ptrdiff_t)fend))) {
|
|
|
return -1;
|
|
|
}
|
|
|
|