Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mime/multipart: problem parsing for certain attachment lengths #12662

Closed
fclaude opened this issue Sep 17, 2015 · 4 comments
Closed

mime/multipart: problem parsing for certain attachment lengths #12662

fclaude opened this issue Sep 17, 2015 · 4 comments

Comments

@fclaude
Copy link
Contributor

fclaude commented Sep 17, 2015

The problem seems to arise when we include a file (as the last element of a multipart-form) whose length makes the final peeking buffer finish with --DELIMITER- (for example, a file with 4031 A's).

I've tried this using go1.5, go1.5.1 and devel. It should affect all architectures.

I've located the problem in function func (mr *Reader) peekBufferSeparatorIndex(peek []byte) (idx int, isEnd bool). This function does the following check:

if len(peek) > 1 && peek[0] == '-' && peek[1] == '-' {
    return idx, true
}
peek = skipLWSPChar(peek)
// Don't have a complete line after the peek.
if bytes.IndexByte(peek, '\n') == -1 {
    return -1, false
}

For the input mentioned, the function returns -1 and ends up consuming the first dash of the delimiter string when reading the content of the file. I've tried a fix for this adding the following condition:

if len(peek) == 0 || len(peek) == 1 && peek[0] == '-' {
    return idx, false
}
if len(peek) > 1 && peek[0] == '-' && peek[1] == '-' {
    return idx, true
}
peek = skipLWSPChar(peek)
// Don't have a complete line after the peek.
if bytes.IndexByte(peek, '\n') == -1 {
    return -1, false
}

With the change the problem doesn't arise anymore and all tests included in the mime/multipart package pass. I'll work on a CL for this fix.

Best Regards,
Francisco Claude.

@fclaude fclaude changed the title Problem mime/multipart Problem parsing mime/multipart for certain attachment lengths Sep 17, 2015
@gopherbot
Copy link

CL https://golang.org/cl/14652 mentions this issue.

@fclaude fclaude changed the title Problem parsing mime/multipart for certain attachment lengths mime/multipart: problem parsing for certain attachment lengths Sep 17, 2015
@ianlancetaylor ianlancetaylor added this to the Go1.6 milestone Sep 17, 2015
@bradfitz bradfitz modified the milestones: Go1.5.2, Go1.6 Oct 12, 2015
@bradfitz
Copy link
Contributor

Flagging this as a potential Go 1.5.2 candidate, since (as noted at perkeep/perkeep#642 (comment)) there's no workaround short of forking all of net/http and mime/multipart, and even then your dependencies may use the unforked version of net/http.

And the fix is tiny.

/cc @adg @mpl

@rsc
Copy link
Contributor

rsc commented Nov 13, 2015

OK for Go 1.5.2

@gopherbot
Copy link

CL https://golang.org/cl/16969 mentions this issue.

aclements pushed a commit that referenced this issue Nov 17, 2015
…t of certain lengths

When parsing the multipart data, if the delimiter appears but doesn't
finish with -- or \n or \r\n, it assumes the data can be consumed. This
is incorrect when the peeking buffer finishes with --delimiter-

Fixes #12662

Change-Id: I329556a9a206407c0958289bf7a9009229120bb9
Reviewed-on: https://go-review.googlesource.com/14652
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-on: https://go-review.googlesource.com/16969
Run-TryBot: Austin Clements <austin@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>
@golang golang locked and limited conversation to collaborators Nov 16, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

5 participants