From: Daniel Gruno <humbedooh@apache.org>
Date: Sun, 20 Apr 2014 13:58:13 +0000 (+0000)
Subject: mod_lua: Use binary strstr for finding endpoints of a multipart object. (How did... 
X-Git-Tag: 2.5.0-alpha~4283
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e1f073ca56a71e41b1cbc0c6cce7812cb70b9d7b;p=apache

mod_lua: Use binary strstr for finding endpoints of a multipart object. (How did this EVER work?! *sigh*)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1588761 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c
index fd8e208cc2..f2de2751ef 100644
--- a/modules/lua/lua_request.c
+++ b/modules/lua/lua_request.c
@@ -317,6 +317,20 @@ static int req_parseargs(lua_State *L)
     return 2;                   /* [table<string, string>, table<string, array<string>>] */
 }
 
+/* ap_lua_binstrstr: Binary strstr function for uploaded data with NULL bytes */
+char* ap_lua_binstrstr (const char * haystack, size_t hsize, const char* needle, size_t nsize)
+{
+    if (haystack == NULL) return NULL;
+    if (needle == NULL) return NULL;
+    if (hsize < nsize) return NULL;
+    for (size_t p = 0; p <= (hsize - nsize); ++p) {
+        if (memcmp(haystack + p, needle, nsize) == 0) {
+            return (char*) (haystack + p);
+        }
+    }
+    return NULL;
+} 
+
 /* r:parsebody(): Parses regular (url-enocded) or multipart POST data and returns two tables*/
 static int req_parsebody(lua_State *L)
 {
@@ -348,15 +362,15 @@ static int req_parsebody(lua_State *L)
         for
         (
             start = strstr((char *) data, multipart);
-            start != start + size;
+            start != NULL;
             start = end
         ) {
             i++;
             if (i == POST_MAX_VARS) break;
-            end = strstr((char *) (start + 1), multipart);
-            if (!end) end = start + size;
             crlf = strstr((char *) start, "\r\n\r\n");
             if (!crlf) break;
+            end = ap_lua_binstrstr(crlf, (size - (crlf - data)), multipart, len);
+            if (end == NULL) break;
             key = (char *) apr_pcalloc(r->pool, 256);
             filename = (char *) apr_pcalloc(r->pool, 256);
             vlen = end - crlf - 8;