bugcgicc - Bugs: bug #34265, missing opportunity to limit POST...


bug #34265: missing opportunity to limit POST data upload

Submitted by:  Andreas Kirsch <kirsche40>
Submitted on:  Sat 10 Sep 2011 04:41:39 PM UTC  
Votes:  10  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: sebastien diaz <sebdiaz>
Open/Closed: Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Fri 28 Mar 2014 01:25:06 PM UTC, comment #1:

I think a simple inclusion of code in the CgiEnvironment.cpp file would do the trick here at line 73 (CgiCC v3.2.12). I would recommend a better error recovery than what I have here though. And of course, the MAX_CONTENTLENGTH constant would have to be defined in CgiEnvironment.h I would presume:

if(stringsAreEqual(fRequestMethod, "post")) {
// Don't use auto_ptr, but vector instead
// Bug reported by -unavailable-
std::vector<char> data(fContentLength);

// If input is 0, use the default implementation of CgiInput
< if ( getContentLength() )

> if ( getContentLength() > MAX_CONTENTLENGTH )
> {
> exit(1);
> }
> else if ( getContentLength() )

// If input is 0, use the default implementation of CgiInput
if ( input == 0 )
if ( local_input.read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
if ( input->read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");

fPostData = std::string( &data[0], getContentLength() );

Thomas Straub <tomstraub>
Sat 10 Sep 2011 04:41:39 PM UTC, original submission:

CGICC does not support any POST data upload limitation. Other CGI implementation have this feature:

another C++ implementation:

> http://rudeserver.com/cgiparser/api.html#maxPostLength

another C++ implementation:

> http://www.chilkatsoft.com/refdoc/xUploadRcvRef.html


> http://perlmeme.org/tutorials/cgi_upload.html


> http://www.php.net/manual/en/ini.core.php#ini.post-max-size


> http://webpy.org/cookbook/limiting_upload_size

Andreas Kirsch <kirsche40>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by tomstraub (Posted a comment)
  • -unavailable- added by kirsche40 (Submitted the item)
  • -unavailable- added by kirsche40

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 10 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 09 Jun 2014 02:12:35 PM UTCsebdiazStatusPostponed=>Fixed
    Sat 12 Jan 2013 08:06:53 PM UTCsebdiazStatusNone=>Postponed
      Assigned toNone=>sebdiaz
    Sat 10 Sep 2011 04:41:39 PM UTCkirsche40Carbon-Copy-=>Added kirsche40

    Back to the top

    Powered by Savane 3.1-cleanup1