Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: ParseMultipartForm panic when the body==nil #48206

Closed
forTWOS opened this issue Sep 6, 2021 · 3 comments
Closed

net/http: ParseMultipartForm panic when the body==nil #48206

forTWOS opened this issue Sep 6, 2021 · 3 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Comments

@forTWOS
Copy link

forTWOS commented Sep 6, 2021

What version of Go are you using (go version)?

go version go1.17 windows/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output
set GO111MODULE=auto
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\xx\AppData\Local\go-build
set GOENV=C:\Users\xx\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\xx\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\xx\go
set GOPRIVATE=
set GOPROXY=https://goproxy.io,direct
set GOROOT=c:\go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=c:\go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.17
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\xx\AppData\Local\Temp\go-build2679503516=/tmp/go-build -gno-record-gcc-switches

What did you do?

package main

import (
	"bytes"
	"fmt"
	"mime/multipart"
	"net/http"
)

func main() {
	buf := new(bytes.Buffer)
	mw := multipart.NewWriter(buf)
	mw.Close()

	Request, _ := http.NewRequest("POST", "/", nil)
	Request.Header.Set("Content-Type", mw.FormDataContentType())

	f, fh, err := Request.FormFile("file")
	if err != nil {
		fmt.Printf("%#+v\n", err)
		return
	}
	f.Close()
	fmt.Printf("%#+v\n", fh)
	return
}

What did you expect to see?

I would like to see an error.

errors.New("missing form body")

What did you see instead?

panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x18 pc=0x77b632]

goroutine 1 [running]:
mime/multipart.(*stickyErrorReader).Read(0xc00005a500, {0xc0000da000, 0x927640, 0x0})
c:/go/src/mime/multipart/multipart.go:127 +0x32
bufio.(*Reader).fill(0xc000066180)
c:/go/src/bufio/bufio.go:101 +0x103
bufio.(*Reader).ReadSlice(0xc000066180, 0x98)
c:/go/src/bufio/bufio.go:360 +0x2f
mime/multipart.(*Reader).nextPart(0xc000022080, 0xf8)
c:/go/src/mime/multipart/multipart.go:335 +0xb6
mime/multipart.(*Reader).NextPart(...)
c:/go/src/mime/multipart/multipart.go:314
mime/multipart.(*Reader).readForm(0xc0000d4000, 0x2000000)
c:/go/src/mime/multipart/formdata.go:52 +0x178
mime/multipart.(*Reader).ReadForm(...)
c:/go/src/mime/multipart/formdata.go:31
net/http.(*Request).ParseMultipartForm(0xc0000d4000, 0x6ad007)
c:/go/src/net/http/request.go:1318 +0xa5
net/http.(*Request).FormFile(0xc0000d4000, {0x7e207c, 0x4})
c:/go/src/net/http/request.go:1376 +0x4f
main.main()
D:/gocode/src/ucenter/app/test/httpformfile/main.go:18 +0x1bb
exit status 2

@seankhliao seankhliao changed the title ParseMultipartForm panic when the body==nil in version1.17 net/http: ParseMultipartForm panic when the body==nil Sep 6, 2021
@seankhliao seankhliao added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Sep 6, 2021
@seankhliao
Copy link
Member

cc @neild

@helbing
Copy link
Contributor

helbing commented Sep 20, 2021

Hi, I've found out why panic. In http.ParseMultipartForm, the method ParseForm returns the error missing form body when Body is equal to nil, and not handled. but Body was used in subsequent function calls (r.multipartReader(false) and mr.ReadForm(maxMemory)).

@gopherbot
Copy link

Change https://go.dev/cl/384454 mentions this issue: net/http: fix nil body causing ParseMultipartForm to panic

@golang golang locked and limited conversation to collaborators Mar 22, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

4 participants