From 82803d1b0edc61107cc105dbaf036689cff3c135 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 17 May 2023 18:15:02 +0200 Subject: [PATCH] http: complete multipart data on open Take as much as we can when opening, by making sure that the boundary is not present --- src/app-layer-htp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index 3b8baae4b6..b2c915d934 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -1604,6 +1604,16 @@ static int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud, if (filedata_len >= (uint32_t)(expected_boundary_len + 2)) { filedata_len -= (expected_boundary_len + 2 - 1); + // take as much as we can until start of boundary + for (size_t nb = 0; nb < (size_t)expected_boundary_len + 1; nb++) { + if (filedata[filedata_len] == '\r') { + if (nb == expected_boundary_len || + filedata[filedata_len + 1] == '\n') { + break; + } + } + filedata_len++; + } SCLogDebug("opening file with partial data"); } else { filedata = NULL; -- 2.47.2