From 4d07a99ee2cd55e2cfe19eed49dd2a440c590a67 Mon Sep 17 00:00:00 2001 From: Kristof Havasi Date: Mon, 23 Aug 2021 08:40:35 +0200 Subject: [PATCH] Fix bug in long HTTP chunk handling Due to a copy/paste error, the start of the payload in the latest parsed chunk was compared to chunk-length of the terminating chunk (5 chars). So only chunks were parsed as expected, which also had a single hex digit length. --- mongoose.c | 2 +- src/http.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index 873090cd..4dc96c38 100644 --- a/mongoose.c +++ b/mongoose.c @@ -1401,7 +1401,7 @@ static void walkchunks(struct mg_connection *c, struct mg_http_message *hm, char *buf2 = (char *) &c->recv.buf[reqlen]; size_t memo2 = c->recv.len; size_t cl2 = get_chunk_length(&buf2[off], memo2 - reqlen - off, &ll); - size_t n = cl < ll + 2 ? 0 : cl2 - ll - 2; + size_t n = cl2 < ll + 2 ? 0 : cl2 - ll - 2; memmove(buf2 + bl, buf2 + off + ll, n); bl += n; off += cl2; diff --git a/src/http.c b/src/http.c index 2f045971..2411f30d 100644 --- a/src/http.c +++ b/src/http.c @@ -990,7 +990,7 @@ static void walkchunks(struct mg_connection *c, struct mg_http_message *hm, char *buf2 = (char *) &c->recv.buf[reqlen]; size_t memo2 = c->recv.len; size_t cl2 = get_chunk_length(&buf2[off], memo2 - reqlen - off, &ll); - size_t n = cl < ll + 2 ? 0 : cl2 - ll - 2; + size_t n = cl2 < ll + 2 ? 0 : cl2 - ll - 2; memmove(buf2 + bl, buf2 + off + ll, n); bl += n; off += cl2;