diff mbox series

BUG: Webserver: SWUPdate crashes with malformed form

Message ID 20240913101640.574828-1-stefano.babic@swupdate.org
State Accepted
Headers show
Series BUG: Webserver: SWUPdate crashes with malformed form | expand

Commit Message

Stefano Babic Sept. 13, 2024, 10:16 a.m. UTC 
Posting a SWU without setting 'filename' in the form crashes the
Webserver. Add the check and return an error.

Signed-off-by: Stefano Babic <stefano.babic@swupdate.org>
---
 mongoose/mongoose_interface.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--
2.34.1
diff mbox series

Patch

diff --git a/mongoose/mongoose_interface.c b/mongoose/mongoose_interface.c
index 0185e593..1d636cdf 100644
--- a/mongoose/mongoose_interface.c
+++ b/mongoose/mongoose_interface.c
@@ -572,7 +572,11 @@  static void upload_handler(struct mg_connection *nc, int ev, void *ev_data)
 				break;
 			}
 			fus->c = nc;
-
+			if (!mp->part.filename.buf) {
+				mg_http_reply(nc, 400, "", "%s", "filename not set in form\n");
+				nc->is_draining = 1;
+				break;
+			}
 			struct swupdate_request req;
 			swupdate_prepare_req(&req);
 			req.len = mp->len;