wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-16 10:39:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Terminate destination buffer in mg_url_decode

Browse Source
This commit is contained in:
robert committed 2026-09-01 17:33:56 +03:00
1 parent 9123330f72
commit 9ddac8faa7
3 files changed
+32 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/http.c
+14 -5
View File
@@ -170,6 +170,7 @@ int mg_url_decode(const char *src, size_t src_len, char *dst, size_t dst_len,
mg_str_to_num(mg_str_n(src + i + 1, 2), 16, &dst[j], sizeof(uint8_t));
i += 2;
} else {
dst[0] = '\0';
return -1;
}
} else if (is_form_url_encoded && src[i] == '+') {
@@ -818,9 +819,11 @@ static int uri_to_path2(struct mg_connection *c, struct mg_http_message *hm,
path[path_size - 1] = '\0';
// Terminate root dir with slash
if (n > 0 && path[n - 1] != '/') path[n++] = '/', path[n] = '\0';
if (url.len < hm->uri.len) {
mg_url_decode(hm->uri.buf + url.len, hm->uri.len - url.len, path + n,
path_size - n, 0);
if (url.len < hm->uri.len &&
mg_url_decode(hm->uri.buf + url.len, hm->uri.len - url.len, path + n,
path_size - n, 0) < 0) {
mg_http_reply(c, 400, "", "Invalid path");
return -1;
}
path[path_size - 1] = '\0'; // Double-check
n = strlen(path);
@@ -972,8 +975,14 @@ long mg_http_upload(struct mg_connection *c, struct mg_http_message *hm,
struct mg_fs *fs, const char *dir, size_t max_size) {
char buf[20] = "0", file[MG_PATH_MAX], path[MG_PATH_MAX];
long res = 0, offset;
mg_http_get_var(&hm->query, "offset", buf, sizeof(buf));
mg_http_get_var(&hm->query, "file", file, sizeof(file));
if (mg_http_get_var(&hm->query, "offset", buf, sizeof(buf)) == -3) {
mg_http_reply(c, 400, "", "invalid offset");
return -3;
}
if (mg_http_get_var(&hm->query, "file", file, sizeof(file)) == -3) {
mg_http_reply(c, 400, "", "invalid file");
return -2;
}
offset = strtol(buf, NULL, 0);
mg_snprintf(path, sizeof(path), "%s%c%s", dir, MG_DIRSEP, file);
if (hm->body.len == 0) {