Skip to content

Commit 164de0f

Browse files
committed
fix: buffer overflow in multipart body proc
1 parent e5d00df commit 164de0f

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/request_body_processor/multipart.cc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ int Multipart::parse_content_disposition(const char *c_d_value, int offset) {
362362
const char* start_of_filename = p;
363363
while ((*p != '\0') && (*p != ';')) {
364364
if (*p == '%') {
365-
if ((*(p+1) == '\0') || (!isxdigit(*(p+1))) || (!isxdigit(*(p+2)))) {
365+
if ((*(p+1) == '\0') || (!isxdigit(*(p+1))) || (*(p+2) == '\0') || (!isxdigit(*(p+2)))) {
366366
return -18;
367367
}
368368
p += 3;
@@ -415,7 +415,9 @@ int Multipart::parse_content_disposition(const char *c_d_value, int offset) {
415415
value.append((p++), 1);
416416
}
417417

418-
p++; /* go over the quote at the end */
418+
if (*p == quote) {
419+
p++; /* go over the quote at the end */
420+
}
419421

420422
} else {
421423
/* not quoted */

0 commit comments

Comments
 (0)