Multipart segfault


It seems that multipart header parsing is not working as expected.
I try to connect a mjpeg video stream (mg_connect_http) but the lib crash at first msg reception.

When debugging the process( v6.6 ), I found the boundary is NULL causing the c_strnstr call to crash on
line 4982 (pd->mp_stream.boundary==NULL).

Further investigations show that the call of mg_http_multipart_begin (just before on line 4761) is early skipped because the nc->listener is NULL (line 4878).

And finally, when commenting the test on the listener, the boundary extraction (line 4895) return an empty string because the mg_http_parse_header does not handle header separated by ';' ie

Content-Type= multipart/x-mixed-replaced;boundary=xxx

line 5844 int ch = ' ', ch1 = ',', ch2 = ';', len = 0, n = strlen(var_name);

/* Find where variable starts */
for (s = hdr->p; s != NULL && s + n < end; s++) {
if ((s == hdr->p || s[-1] == ch || s[-1] == ch1 || s[-1]==ch2) && s[n] == '=' &&
!memcmp(s, var_name, n))

I do not fully read the code and i m not sure that this patch is correct ...


Sign In or Register to comment.