Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CGI POST data truncated when content length is non-zero multiple of 128 #18

Open
shattar opened this issue Jan 31, 2019 · 0 comments
Open

Comments

@shattar
Copy link

shattar commented Jan 31, 2019

In "boost/cgi/cgi/request_service.hpp" in parse_post_vars(), the remaining bytes to read is decremented twice for a single read. Once in the client read_some, and once in the request service parst_post_vars. This is because a reference to the client bytes_left is used rather than a copy of the bytes left.

std::size_t& bytes_left (impl.client_.bytes_left_);

Should be
std::size_t bytes_left (impl.client_.bytes_left_);

For content lengths that are not multiples of 128, the double decrement rolls over and the post data is read until the eof is encountered, possibly greater than the content length.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant