Skip to content

Conversation

@pellucide
Copy link
Contributor

For a POST parameter with a large value, libmicrohttpd will call webserver::post_iterator
multiple times with chunks of post data and successive offsets. Currently, set_arg will
overwrites the value. So after all the post_iterator calls, the value will be
set to the last chunk.

This change fixes the set_arg() function(s).. by checking for an existing value and appending the new chunk.

the bug can be tested with the following script.

STR="1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
1234567890abcdefghijklmnopqrstuvwxyz
"
curl -X POST --data "aaa=$STR" http://127.0.0.1:8080/service

…erver::post_iterator

multiple times with chunnks of post data and successibe offsets. Currently, set_arg will
overwrites the value. So after all the successive post_iterator calls, the value will be
set to the last chunk.

This change fixes the set_arg() function(s).. by checking for existing value and appending to it
than overwriting it.
@coveralls
Copy link

Coverage Status

Coverage remained the same at 81.476% when pulling c2c9656 on pellucide:master into 496458f on etr:master.

@wlandry
Copy link
Contributor

wlandry commented Apr 18, 2016

Modifying set_args this way means that if there is an key that is both a url parameter and a POST parameter, as in this curl call

curl -F "foo=bar" http://localhost/?foo=baz

then the url parameter value for the key foo will be appended to the POST'ed value, resulting in barbaz. My pull request would instead replace the POST'ed value with the url parameter.

@etr
Copy link
Owner

etr commented Apr 18, 2016

This fixes. Thank you!

@etr etr merged commit fe2d6ab into etr:master Apr 18, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants