Fri 28 Mar 2014 01:25:06 PM UTC, comment #1:
I think a simple inclusion of code in the CgiEnvironment.cpp file would do the trick here at line 73 (CgiCC v3.2.12). I would recommend a better error recovery than what I have here though. And of course, the MAX_CONTENTLENGTH constant would have to be defined in CgiEnvironment.h I would presume:
if(stringsAreEqual(fRequestMethod, "post")) {
// Don't use auto_ptr, but vector instead
// Bug reported by -unavailable-
std::vector<char> data(fContentLength);
// If input is 0, use the default implementation of CgiInput
73c73,77
< if ( getContentLength() )
---
> if ( getContentLength() > MAX_CONTENTLENGTH )
> {
> exit(1);
> }
> else if ( getContentLength() )
// If input is 0, use the default implementation of CgiInput
if ( input == 0 )
{
if ( local_input.read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
}
else
if ( input->read( &data[0], getContentLength() ) != getContentLength() )
throw std::runtime_error("I/O error");
fPostData = std::string( &data[0], getContentLength() );
}
}
|