Function readPostBody

cgiutil.c:44–117

#define CR 13

static char *readPostBody( cgiRequestObj *request ) 
{
  char *data; 
  size_t data_max, data_len;
  int chunk_size;

  msIO_needBinaryStdin();

  /* -------------------------------------------------------------------- */
  /*      If the length is provided, read in one gulp.                    */
  /* -------------------------------------------------------------------- */
  if( getenv("CONTENT_LENGTH") != NULL ) {
    data_max = (size_t) atoi(getenv("CONTENT_LENGTH"));
    /* Test for suspicious CONTENT_LENGTH (negative value or SIZE_MAX) */
    if( data_max >= SIZE_MAX ) {
      msIO_printf("Content-type: text/html%c%c",10,10);
      msIO_printf("Suspicious Content-Length.\n");
      exit( 1 );
    }
    data = (char *) malloc(data_max+1);
    if( data == NULL ) {
      msIO_printf("Content-type: text/html%c%c",10,10);
      msIO_printf("malloc() failed, Content-Length: %u unreasonably large?\n", data_max );
      exit( 1 );
    }

    if( (int) msIO_fread(data, 1, data_max, stdin) < data_max ) {
      msIO_printf("Content-type: text/html%c%c",10,10);
      msIO_printf("POST body is short\n");
      exit(1);
    }

    data[data_max] = '\0';
    return data;
  }
  /* -------------------------------------------------------------------- */
  /*      Otherwise read in chunks to the end.                            */
  /* -------------------------------------------------------------------- */
#define DATA_ALLOC_SIZE 10000

  data_max = DATA_ALLOC_SIZE;
  data_len = 0;
  data = (char *) malloc(data_max+1);
  if (data == NULL) {
    msIO_printf("Content-type: text/html%c%c",10,10);
    msIO_printf("Out of memory allocating %u bytes.\n", data_max+1);
    exit(1);
  }

  while( (chunk_size = msIO_fread( data + data_len, 1, data_max-data_len, stdin )) > 0 ) {
    data_len += chunk_size;

    if( data_len == data_max ) {
      /* Realloc buffer, making sure we check for possible size_t overflow */
        if ( data_max > SIZE_MAX - (DATA_ALLOC_SIZE+1) ) {
        msIO_printf("Content-type: text/html%c%c",10,10);
        msIO_printf("Possible size_t overflow, cannot reallocate input buffer, POST body too large?\n" );
        exit(1);