Limit the number of header lines per multipart form-data part

The multipart/form-data parser bounded the length of each individual
header line via CPPHTTPLIB_HEADER_MAX_LENGTH but did not cap how many
header lines a single part could contain. Within the overall payload
limit, a client could pack a large number of small header lines into
one part, each of which is parsed twice, inflating CPU usage.

Add a per-part header-line counter that resets when a new entry begins
and abort parsing once it reaches CPPHTTPLIB_HEADER_MAX_COUNT, mirroring
the limit already enforced by read_headers() for request headers.
This commit is contained in:
Mario Limonciello authored and Mario Limonciello (AMD) committed 2026-07-18 19:20:51 -05:00
1 parent 0c1cc8c986
commit 877a52f6b3
2 files changed
+46

No files matched your search

+9
View File
@@ -8095,6 +8095,13 @@ public:
break;
}
// Check header count limit
if (header_count_ >= CPPHTTPLIB_HEADER_MAX_COUNT) {
is_valid_ = false;
return false;
}
header_count_++;
const auto header = buf_head(pos);
if (!parse_header(header.data(), header.data() + header.size(),
@@ -8210,6 +8217,7 @@ private:
file_.filename.clear();
file_.content_type.clear();
file_.headers.clear();
header_count_ = 0;
}
bool start_with_case_ignore(const std::string &a, const char *b,
@@ -8263,6 +8271,7 @@ private:
size_t state_ = 0;
bool is_valid_ = false;
FormData file_;
size_t header_count_ = 0;
// Buffer
bool start_with(const std::string &a, size_t spos, size_t epos,