bugcgicc - Bugs: bug #34265, missing opportunity to limit POST...


bug #34265: missing opportunity to limit POST data upload

Submitted by:  Andreas Kirsch <kirsche40>
Submitted on:  Sat Sep 10 16:41:39 2011  
Votes:  10  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: sebastien diaz <sebdiaz>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


Fri Mar 28 13:25:06 2014, comment #1:

I think a simple inclusion of code in the CgiEnvironment.cpp file would do the trick here at line 73 (CgiCC v3.2.12). I would recommend a better error recovery than what I have here though. And of course, the MAX_CONTENTLENGTH constant would have to be defined in CgiEnvironment.h I would presume:

if(stringsAreEqual(fRequestMethod, "post")) {
// Don't use auto_ptr, but vector instead
// Bug reported by -unavailable-
std::vector<char> data(fContentLength);

// If input is 0, use the default implementation of CgiInput
< if ( getContentLength() )

> if ( getContentLength() > MAX_CONTENTLENGTH )
> {
> exit(1);
> }
> else if ( getContentLength() )

// If input is 0, use the default implementation of CgiInput
if ( input == 0 )
if ( local_input.read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
if ( input->read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");

fPostData = std::string( &data[0], getContentLength() );

Thomas Straub <tomstraub>
Sat Sep 10 16:41:39 2011, original submission:

CGICC does not support any POST data upload limitation. Other CGI implementation have this feature:

another C++ implementation:

> http://rudeserver.com/cgiparser/api.html#maxPostLength

another C++ implementation:

> http://www.chilkatsoft.com/refdoc/xUploadRcvRef.html


> http://perlmeme.org/tutorials/cgi_upload.html


> http://www.php.net/manual/en/ini.core.php#ini.post-max-size


> http://webpy.org/cookbook/limiting_upload_size

Andreas Kirsch <kirsche40>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by tomstraub (Posted a comment)
  • -unavailable- added by kirsche40 (Submitted the item)
  • -unavailable- added by kirsche40

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 10 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon Jun 9 14:12:35 2014sebdiazStatusPostponed=>Fixed
    Sat Jan 12 20:06:53 2013sebdiazStatusNone=>Postponed
      Assigned toNone=>sebdiaz
    Sat Sep 10 16:41:39 2011kirsche40Carbon-Copy-=>Added kirsche40

    Back to the top

    Powered by Savane 3.1-cleanup1