libmicrohttpd

commit c13f4c6484febc80e6533144600acb58ce469db6
parent 29eaa56b31d5df4186e2486a7d393bf76d65086c
Author: Christian Grothoff <christian@grothoff.org>
Date:   Mon, 27 Jul 2026 18:00:30 +0200

fix parsing of chunk-extension lines that previously failed to skip the \r\n properly; might be abused for HTTP request smuggling; thanks to A. Ramos for reporting

Diffstat:
M
src/microhttpd/connection.c
 | 
4
++--

1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/microhttpd/connection.c b/src/microhttpd/connection.c
@@ -4651,13 +4651,13 @@ process_request_body (struct MHD_Connection *connection)
                 if (i + 1 == available)
                   break; /* need more data */
                 if ('\n' == buffer_head[i + 1])
-                  chunk_size_line_len = i; /* Valid chunk header */
+                  chunk_size_line_len = i + 2; /* Valid chunk header */
               }
               else
               {
                 mhd_assert ('\n' == buffer_head[i]);
                 if (bare_lf_as_crlf)
-                  chunk_size_line_len = i; /* Valid chunk header */
+                  chunk_size_line_len = i + 1; /* Valid chunk header */
               }
               /* The chunk header is broken
                  if chunk_size_line_len is zero here. */