From 749277d46fffbf7a1caa0f44563b39c65e658bb5 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 26 Jan 2023 09:28:46 +0100 Subject: [PATCH] http: complete multipart until request.body-limit In the case we are truncating a multipart file because of reaching request.body-limit, we used to not consume the whole buffer, but keep expected_boundary_len bytes in case a new boundary begins in these bytes. Even if we cannot check the complete boundary, we can still check the first bytes, as will be done in the rust version. Ticket: #5952 (cherry picked from commit 578f328e06b3e03f3bdbbf852b5d121e20849b8b) (cherry picked from commit caf9940fd10f474bcbc7bf983e3849a83a8c7562) --- src/app-layer-htp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index d01fa16a70..f232b2f7e4 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -1438,6 +1438,16 @@ static int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud, if (chunks_buffer_len > expected_boundary_end_len) { const uint8_t *filedata = chunks_buffer; uint32_t filedata_len = chunks_buffer_len - expected_boundary_len; + for (; filedata_len < chunks_buffer_len; filedata_len++) { + // take as much as we can until the beginning of a new line + if (chunks_buffer[filedata_len] == '\r') { + if (filedata_len + 1 == chunks_buffer_len || + chunks_buffer[filedata_len + 1] == '\n') { + break; + } + } + } + #ifdef PRINT printf("FILEDATA (part) START: \n"); PrintRawDataFp(stdout, filedata, filedata_len); -- 2.47.2