diff options
| author | Dan Fandrich <dan@coneharvesters.com> | 2010-08-24 16:45:31 -0700 |
|---|---|---|
| committer | Dan Fandrich <dan@coneharvesters.com> | 2010-08-24 16:45:31 -0700 |
| commit | 77ba147e762b4a0db33d712a5d6a8eeeb50011f4 (patch) | |
| tree | b697c8c25ccf4231483e4ac0d6580d608593fba5 /src | |
| parent | bed311eda27a3c7c87f0988310462414c54e5384 (diff) | |
Fixed a NULL pointer dereference in form posting
It was introduced in commit eeb2cb05 along with the -F type=
change. Also fixed a typo in the name of the magic filename=
parameter. Tweaked tests 39 and 173 to better test this path.
Diffstat (limited to 'src')
| -rw-r--r-- | src/main.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/main.c b/src/main.c index 093f6bed4..3734c94fd 100644 --- a/src/main.c +++ b/src/main.c @@ -1210,8 +1210,13 @@ static int formparse(struct Configurable *config, specified and if not we simply assume that it is text that the user wants included in the type and include that too up to the next zero or semicolon. */ - if((*sep==';') && !curlx_strnequal(";filname=", sep, 9)) - sep = strchr(sep+1, ';'); + if((*sep==';') && !curlx_strnequal(";filename=", sep, 10)) { + sep2 = strchr(sep+1, ';'); + if (sep2) + sep = sep2; + else + sep = sep+strlen(sep); /* point to end of string */ + } if(*sep) { *sep=0; /* zero terminate type string */ |