mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-17 10:59:39 +00:00
Limit the number of header lines per multipart form-data part
The multipart/form-data parser bounded the length of each individual header line via CPPHTTPLIB_HEADER_MAX_LENGTH but did not cap how many header lines a single part could contain. Within the overall payload limit, a client could pack a large number of small header lines into one part, each of which is parsed twice, inflating CPU usage. Add a per-part header-line counter that resets when a new entry begins and abort parsing once it reaches CPPHTTPLIB_HEADER_MAX_COUNT, mirroring the limit already enforced by read_headers() for request headers.
This commit is contained in:
1 parent
0c1cc8c986
commit
877a52f6b3
2 files changed
+46
No files matched your search
@@ -8095,6 +8095,13 @@ public:
|
||||
break;
|
||||
}
|
||||
|
||||
// Check header count limit
|
||||
if (header_count_ >= CPPHTTPLIB_HEADER_MAX_COUNT) {
|
||||
is_valid_ = false;
|
||||
return false;
|
||||
}
|
||||
header_count_++;
|
||||
|
||||
const auto header = buf_head(pos);
|
||||
|
||||
if (!parse_header(header.data(), header.data() + header.size(),
|
||||
@@ -8210,6 +8217,7 @@ private:
|
||||
file_.filename.clear();
|
||||
file_.content_type.clear();
|
||||
file_.headers.clear();
|
||||
header_count_ = 0;
|
||||
}
|
||||
|
||||
bool start_with_case_ignore(const std::string &a, const char *b,
|
||||
@@ -8263,6 +8271,7 @@ private:
|
||||
size_t state_ = 0;
|
||||
bool is_valid_ = false;
|
||||
FormData file_;
|
||||
size_t header_count_ = 0;
|
||||
|
||||
// Buffer
|
||||
bool start_with(const std::string &a, size_t spos, size_t epos,
|
||||
|
||||
Reference in new issue
Block a user