Skip to content

Commit bcc1ead

Browse files
etrclaude
andcommitted
Fix null key dereference in post_iterator (#375)
MHD may invoke the post iterator with a null key on a continuation chunk (off > 0): the field name is supplied only on the first call and not repeated. The no-file branch passed the raw key pointer into std::string (via grow_last_arg / set_arg), which throws std::logic_error on null. Because the throw escapes the C post-iterator callback, it propagates as an uncaught exception and aborts the process via std::terminate. Guard key for null before constructing std::string: with no field name there is nothing to store the value under, so accept and silently skip the chunk (MHD_YES keeps the request alive; MHD_NO would abort it). Same class of bug as the null-uri fix in uri_log (#371). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rkuh4aSmrD8m2f2vYqakb6
1 parent 8b6aeb0 commit bcc1ead

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

src/webserver.cpp

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -832,6 +832,20 @@ MHD_Result webserver::post_iterator(void *cls, enum MHD_ValueKind kind,
832832
struct details::modded_request* mr = (struct details::modded_request*) cls;
833833

834834
if (!filename) {
835+
// MHD may invoke the post iterator with a null key on a
836+
// continuation chunk (off > 0): the field name was supplied on the
837+
// first call and is not repeated. With no field name there is
838+
// nothing to store the value under, so silently accept the chunk
839+
// (MHD_YES tells MHD to continue; MHD_NO would abort the whole
840+
// request). Guarding here also stops the raw pointer from reaching
841+
// std::string, which throws std::logic_error on null and aborts the
842+
// process via std::terminate because the throw escapes a C
843+
// callback. See issue #375 (same class of bug as the null-uri fix
844+
// in uri_log, issue #371).
845+
if (!key) {
846+
return MHD_YES;
847+
}
848+
835849
// There is no actual file, just set the arg key/value and return.
836850
if (off > 0) {
837851
mr->dhr->grow_last_arg(key, std::string(data, size));

0 commit comments

Comments
 (0)