Enforce payload_max_length on decompressed size for unframed requests

For a non-SSL request with neither Content-Length nor Transfer-Encoding,
Server::read_content_core() fell back to reading raw wire bytes with
detail::read_content_without_length() directly, bypassing the decompressor
wrapper that the length-framed and chunked paths already use. As a result,
payload_max_length only bounded the compressed bytes read off the socket,
not the decompressed size a handler could produce from them.

Route this fallback through detail::read_content(..., decompress=true)
instead, the same helper already used below for the length-framed and
chunked cases, so the decompressed-size guard applies uniformly.
This commit is contained in:
yhirose committed 2026-08-13 23:35:30 -04:00
1 parent f00e476f1b
commit 89e0c5c238
2 files changed
+71 -9

No files matched your search

+6 -9
View File
@@ -12704,15 +12704,12 @@ inline bool Server::read_content_core(
}
}
if (has_data) {
auto result =
detail::read_content_without_length(strm, payload_max_length_, out);
if (result == detail::ReadContentResult::PayloadTooLarge) {
res.status = StatusCode::PayloadTooLarge_413;
return false;
} else if (result != detail::ReadContentResult::Success) {
return false;
}
return true;
// Route through the same decompressing reader used by the
// length-framed and chunked paths below, so payload_max_length_ is
// enforced on the decompressed size here too instead of only on the
// compressed wire bytes.
return detail::read_content(strm, req, payload_max_length_, res.status,
nullptr, out, true);
}
}
return true;