darrengarvey / cgi

CGI and FastCGI C++ Library
http://cgi.sf.net
51 stars 32 forks source link

CGI POST data truncated when content length is non-zero multiple of 128 #18

Open shattar opened 5 years ago

shattar commented 5 years ago

In "boost/cgi/cgi/request_service.hpp" in parse_post_vars(), the remaining bytes to read is decremented twice for a single read. Once in the client read_some, and once in the request service parst_post_vars. This is because a reference to the client bytes_left is used rather than a copy of the bytes left.

std::size_t& bytes_left (impl.client_.bytes_left_);

Should be std::size_t bytes_left (impl.client_.bytes_left_);

For content lengths that are not multiples of 128, the double decrement rolls over and the post data is read until the eof is encountered, possibly greater than the content length.