-fix post processor, expanded test suite to cover garbage before payload

1 files changed, 19 insertions, 3 deletions

diff --git a/src/microhttpd/postprocessor.c b/src/microhttpd/postprocessor.c
index 0fdf607f..892eabdd 100644
--- a/src/microhttpd/postprocessor.c
+++ b/src/microhttpd/postprocessor.c
@@ -533,18 +533,34 @@ find_boundary (struct MHD_PostProcessor *pp,
                enum PP_State next_state, enum PP_State next_dash_state)
 {
   char *buf = (char *) &pp[1];
+  const char *dash;
 
   if (pp->buffer_pos < 2 + blen)
     {
       if (pp->buffer_pos == pp->buffer_size)
         pp->state = PP_Error;   /* out of memory */
-      ++(*ioffptr);
+      // ++(*ioffptr);
       return MHD_NO;            /* not enough data */
     }
   if ((0 != memcmp ("--", buf, 2)) || (0 != memcmp (&buf[2], boundary, blen)))
     {
       if (pp->state != PP_Init)
-        pp->state = PP_Error;
+        {
+          /* garbage not allowed */
+          pp->state = PP_Error;
+        }
+      else
+        {
+          /* skip over garbage (RFC 2046, 5.1.1) */
+          dash = memchr (buf, '-', pp->buffer_pos);
+          if (NULL == dash)
+            (*ioffptr) += pp->buffer_pos; /* skip entire buffer */
+          else
+            if (dash == buf)
+              (*ioffptr)++; /* at least skip one byte */
+            else
+              (*ioffptr) += dash - buf; /* skip to first possible boundary */
+        }
       return MHD_NO;            /* expected boundary */
     }
   /* remove boundary from buffer */
@@ -699,7 +715,7 @@ process_value_to_boundary (struct MHD_PostProcessor *pp,
     {
       while (newline + 4 < pp->buffer_pos)
         {
-          r = memchr (&buf[newline], '\r', pp->buffer_pos - newline);
+          r = memchr (&buf[newline], '\r', pp->buffer_pos - newline - 4);
           if (NULL == r)
           {
             newline = pp->buffer_pos - 4;