|  | @@ -640,6 +640,11 @@ mg_handle_form_request(struct mg_connection *conn,
 | 
											
												
													
														|  |  				nbeg = strstr(nbeg + 1, "name=\"");
 |  |  				nbeg = strstr(nbeg + 1, "name=\"");
 | 
											
												
													
														|  |  			}
 |  |  			}
 | 
											
												
													
														|  |  
 |  |  
 | 
											
												
													
														|  | 
 |  | +			/* This line is not required, but otherwise some compilers
 | 
											
												
													
														|  | 
 |  | +			 * generate spurious warnings. */
 | 
											
												
													
														|  | 
 |  | +			nend = nbeg;
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +			/* If name=" is found, search for the closing " */
 | 
											
												
													
														|  |  			if (nbeg) {
 |  |  			if (nbeg) {
 | 
											
												
													
														|  |  				nbeg += 6;
 |  |  				nbeg += 6;
 | 
											
												
													
														|  |  				nend = strchr(nbeg, '\"');
 |  |  				nend = strchr(nbeg, '\"');
 | 
											
										
											
												
													
														|  | @@ -677,6 +682,12 @@ mg_handle_form_request(struct mg_connection *conn,
 | 
											
												
													
														|  |  				/* It could be somethingfilename= instead of filename= */
 |  |  				/* It could be somethingfilename= instead of filename= */
 | 
											
												
													
														|  |  				fbeg = strstr(fbeg + 1, "filename=\"");
 |  |  				fbeg = strstr(fbeg + 1, "filename=\"");
 | 
											
												
													
														|  |  			}
 |  |  			}
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +			/* This line is not required, but otherwise some compilers
 | 
											
												
													
														|  | 
 |  | +			 * generate spurious warnings. */
 | 
											
												
													
														|  | 
 |  | +			fend = fbeg;
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +			/* If filename=" is found, search for the closing " */
 | 
											
												
													
														|  |  			if (fbeg) {
 |  |  			if (fbeg) {
 | 
											
												
													
														|  |  				fbeg += 10;
 |  |  				fbeg += 10;
 | 
											
												
													
														|  |  				fend = strchr(fbeg, '\"');
 |  |  				fend = strchr(fbeg, '\"');
 | 
											
										
											
												
													
														|  | @@ -710,9 +721,7 @@ mg_handle_form_request(struct mg_connection *conn,
 | 
											
												
													
														|  |  			 * a request like name=filename=xyz. Check if name and
 |  |  			 * a request like name=filename=xyz. Check if name and
 | 
											
												
													
														|  |  			 * filename do not overlap. */
 |  |  			 * filename do not overlap. */
 | 
											
												
													
														|  |  			if (!(((ptrdiff_t)fbeg > (ptrdiff_t)nend)
 |  |  			if (!(((ptrdiff_t)fbeg > (ptrdiff_t)nend)
 | 
											
												
													
														|  | -			      || ((ptrdiff_t)nbeg > (ptrdiff_t)fend)
 |  | 
 | 
											
												
													
														|  | -
 |  | 
 | 
											
												
													
														|  | -			          )) {
 |  | 
 | 
											
												
													
														|  | 
 |  | +			      || ((ptrdiff_t)nbeg > (ptrdiff_t)fend))) {
 | 
											
												
													
														|  |  				return -1;
 |  |  				return -1;
 | 
											
												
													
														|  |  			}
 |  |  			}
 | 
											
												
													
														|  |  
 |  |  
 |