bugcgicc - Bugs: bug #60961, wrong file length if file upload...

 
 

bug #60961: wrong file length if file upload via POST as "multipart/form-data"

Submitter:  None
Submitted:  Fri 23 Jul 2021 07:53:15 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 23 Jul 2021 10:27:16 AM UTC, comment #2: 

The problem is the line 494 in Cgicc.cpp, the '-2' is wrong, because at end of file content there i no trailing \r\n. The comment in lin 492 is wrong, too.

The fix is easy:
--------------------------------------------
Index: cgicc/Cgicc.cpp
===================================================================
RCS file: /sources/cgicc/cgicc/cgicc/Cgicc.cpp,v
retrieving revision 1.34
diff -b -d -u -r1.34 Cgicc.cpp
--- cgicc/Cgicc.cpp 23 Apr 2014 20:55:04 -0000 1.34
+++ cgicc/Cgicc.cpp 23 Jul 2021 10:25:58 -0000
@@ -489,9 +489,9 @@
   if(std::string::npos == headLimit)
     throw std::runtime_error("Malformed input");
 
-  // Extract the value - there is still a trailing CR/LF to be subtracted off
+  // Extract the value
   std::string::size_type valueStart = headLimit + end.length();
-  std::string value = data.substr(valueStart, data.length() - valueStart - 2);
+  std::string value = data.substr(valueStart, data.length() - valueStart);
 
   // Parse the header - pass trailing CR/LF x 2 to parseHeader
   MultipartHeader head = parseHeader(data.substr(0, valueStart));
--------------------------------------------

Andreas Romeyke <art1pirat>
Fri 23 Jul 2021 08:56:06 AM UTC, comment #1: 

The problem is around lines 494-497 in file Cgicc.cpp. If someone has experience with multipart forms, he could help me to find the exact error location and fix it.

Andreas Romeyke <art1pirat>
Fri 23 Jul 2021 07:53:15 AM UTC, original submission:  

Hi,
If you upload a file via POST as "multipart/form-data" to a C++ program
compiled with libcgicc3, the transmitted file length is 2 bytes too short.


I have attached two files that can be used to reproduce the problem. The C++
file must be compiled with 'g++ test_file_upload_post_cgicc.cpp -lcgicc'. With
the attached perl test file you can trigger the problem. Then evaluate the
output of the debug.* files (generated by CGI) and compare it with the file that was uploaded. In
the Perl test this is 4bytes large.

The file is shortened by 2 bytes, see debug.* files.


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #51682:  test_file_upload_post_cgicc.cpp added by None (2KiB - text/x-c++src - files to reproduce the problem)
file #51683:  validate.t added by None (1KiB - application/x-perl - files to reproduce the problem)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by art1pirat (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-07-23 None Attached File- Added test_file_upload_post_cgicc.cpp, #51682
        Attached File- Added validate.t, #51683

    Back to the top

    Powered by Savane 3.13-b921.
    Corresponding source code