From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 17 May 2023 16:15:02 +0000 (+0200)
Subject: http: complete multipart data on open
X-Git-Tag: suricata-7.0.0-rc2~73
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=82803d1b0edc61107cc105dbaf036689cff3c135;p=thirdparty%2Fsuricata.git

http: complete multipart data on open

Take as much as we can when opening, by making sure that the
boundary is not present
---

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 3b8baae4b6..b2c915d934 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1604,6 +1604,16 @@ static int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud,
 
                     if (filedata_len >= (uint32_t)(expected_boundary_len + 2)) {
                         filedata_len -= (expected_boundary_len + 2 - 1);
+                        // take as much as we can until start of boundary
+                        for (size_t nb = 0; nb < (size_t)expected_boundary_len + 1; nb++) {
+                            if (filedata[filedata_len] == '\r') {
+                                if (nb == expected_boundary_len ||
+                                        filedata[filedata_len + 1] == '\n') {
+                                    break;
+                                }
+                            }
+                            filedata_len++;
+                        }
                         SCLogDebug("opening file with partial data");
                     } else {
                         filedata = NULL;