IE does not use quotes but now we are safe...

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 17e2b55093f90885f43faa750bb5f381201c48db..80d56b6d59f21cb28acfced818175ccec94cd9c0 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -642,21 +642,20 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        boundary++;
        boundary_len = strlen(boundary);
 
-       if (boundary[0] == '"' && boundary[boundary_len-1] == '"') {
-               if (boundary_len < 2) { /* otherwise a single " passes */
+       if (boundary[0] == '"') {
+               boundary++;
+               boundary_end = strchr(boundary, '"');
+               if (!boundary_end) { 
                        sapi_module.sapi_error(E_WARNING, "Invalid boundary in multipart/form-data POST data");
                        return;
                }
-               boundary++;
-               boundary_len -= 2;
-               boundary[boundary_len] = '\0';
        } else {
                /* search for the end of the boundary */
                boundary_end = strchr(boundary, ',');
-               if (boundary_end) {
-                       boundary_end[0] = '\0';
-                       boundary_len = boundary_end-boundary;
-               }
+       }
+       if (boundary_end) {
+               boundary_end[0] = '\0';
+               boundary_len = boundary_end-boundary;
        }
 
        /* Initialize the buffer */