libmicrohttpd

commit 43f13d6f3b84b693f64b015b9242e3fcf59ec39b
parent e7783a687eadd469a06b5fe2c0e52d700a735cf0
Author: Christian Grothoff <christian@grothoff.org>
Date:   Fri, 23 May 2008 22:49:29 +0000

fixing issue with large urlencoded uploads

Diffstat:
M
src/daemon/postprocessor.c
 | 
17
+++++++++++++----

1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/src/daemon/postprocessor.c b/src/daemon/postprocessor.c
@@ -310,6 +310,7 @@ post_process_urlencoded (struct MHD_PostProcessor *pp,
   unsigned int poff;
   unsigned int xoff;
   unsigned int delta;
+  int end_of_value_found;
   char *buf;
   char xbuf[XBUF_SIZE + 1];
 
@@ -355,11 +356,14 @@ post_process_urlencoded (struct MHD_PostProcessor *pp,
           /* find last position in input buffer that is part of the value */
           amper = 0;
           while ((amper + poff < post_data_len) &&
+		 (amper < XBUF_SIZE) && 
                  (post_data[amper + poff] != '&') &&
                  (post_data[amper + poff] != '\n') &&
                  (post_data[amper + poff] != '\r'))
             amper++;
-
+	  end_of_value_found = ( (post_data[amper + poff] == '&') ||
+				 (post_data[amper + poff] == '\n') ||
+				 (post_data[amper + poff] == '\r') );
           /* compute delta, the maximum number of bytes that we will be able to
              process right now (either amper-limited of xbuf-size limited) */
           delta = amper;
@@ -400,12 +404,17 @@ post_process_urlencoded (struct MHD_PostProcessor *pp,
           MHD_http_unescape (xbuf);
 
           /* finally: call application! */
-          pp->ikvi (pp->cls, MHD_POSTDATA_KIND, (const char *) &pp[1],  /* key */
-                    NULL, NULL, NULL, xbuf, pp->value_offset, xoff);
+          if (MHD_NO ==
+	      pp->ikvi (pp->cls, MHD_POSTDATA_KIND, (const char *) &pp[1],  /* key */
+			NULL, NULL, NULL, xbuf, pp->value_offset, xoff))
+	    {
+	      pp->state = PP_Error;
+	      return MHD_NO;
+	    }
           pp->value_offset += xoff;
 
           /* are we done with the value? */
-          if (poff < post_data_len)
+          if (end_of_value_found)
             {
               /* we found the end of the value! */
               pp->state = PP_Init;