From c13f4c6484febc80e6533144600acb58ce469db6 Mon Sep 17 00:00:00 2001 From: Christian Grothoff Date: Mon, 27 Jul 2026 18:00:30 +0200 Subject: [PATCH] fix parsing of chunk-extension lines that previously failed to skip the \r\n properly; might be abused for HTTP request smuggling; thanks to A. Ramos for reporting --- src/microhttpd/connection.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/microhttpd/connection.c b/src/microhttpd/connection.c index ff1422e5..1517f5c1 100644 --- a/src/microhttpd/connection.c +++ b/src/microhttpd/connection.c @@ -4651,13 +4651,13 @@ process_request_body (struct MHD_Connection *connection) if (i + 1 == available) break; /* need more data */ if ('\n' == buffer_head[i + 1]) - chunk_size_line_len = i; /* Valid chunk header */ + chunk_size_line_len = i + 2; /* Valid chunk header */ } else { mhd_assert ('\n' == buffer_head[i]); if (bare_lf_as_crlf) - chunk_size_line_len = i; /* Valid chunk header */ + chunk_size_line_len = i + 1; /* Valid chunk header */ } /* The chunk header is broken if chunk_size_line_len is zero here. */