libmicrohttpd

commit 29eaa56b31d5df4186e2486a7d393bf76d65086c
parent bd49ce930bac4a70cfda312d2f278fad5de53ee5
Author: Christian Grothoff <christian@grothoff.org>
Date:   Mon, 27 Jul 2026 17:54:35 +0200

fix read-buffer shift back underflow in special conditionas with trailing query arguments without '='; thanks to A. Ramos for reporting

Diffstat:
M
src/microhttpd/connection.c
 | 
22
+++++++++++++++++++---

1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/src/microhttpd/connection.c b/src/microhttpd/connection.c
@@ -6657,12 +6657,28 @@ get_req_headers (struct MHD_Connection *c, bool process_footers)
        */
       const char *last_elmnt_end;
       size_t shift_back_size;
+
       if (NULL != c->rq.headers_received_tail)
-        last_elmnt_end =
-          c->rq.headers_received_tail->value
-          + c->rq.headers_received_tail->value_size;
+      {
+        if (NULL == c->rq.headers_received_tail->value)
+        {
+          /* Tailing query argument without '=', we only have the header */
+          last_elmnt_end =
+            c->rq.headers_received_tail->header
+            + c->rq.headers_received_tail->header_size;
+        }
+        else
+        {
+          last_elmnt_end =
+            c->rq.headers_received_tail->value
+            + c->rq.headers_received_tail->value_size;
+        }
+      }
       else
+      {
         last_elmnt_end = c->rq.version + HTTP_VER_LEN;
+      }
+      mhd_assert (NULL != last_elmnt_end);
       mhd_assert ((last_elmnt_end + 1) < c->read_buffer);
       shift_back_size = (size_t) (c->read_buffer - (last_elmnt_end + 1));
       if (0 != c->read_buffer_offset)