commit beb5003

Merge branch 'master' into curl-smtp

 1@@ -398,6 +398,7 @@ xs_val *xs_dup(const xs_val *data)
 2 xs_val *xs_expand(xs_val *data, int offset, int size)
 3 /* opens a hole in data */
 4 {
 5+    xstype type = xs_type(data);
 6     int sz = xs_size(data);
 7     int n;
 8 
 9@@ -410,9 +411,9 @@ xs_val *xs_expand(xs_val *data, int offset, int size)
10     for (n = sz - 1; n >= offset + size; n--)
11         data[n] = data[n - size];
12 
13-    if (xs_type(data) == XSTYPE_LIST ||
14-        xs_type(data) == XSTYPE_DICT ||
15-        xs_type(data) == XSTYPE_DATA)
16+    if (type == XSTYPE_LIST ||
17+        type == XSTYPE_DICT ||
18+        type == XSTYPE_DATA)
19         _xs_put_size(data, sz);
20 
21     return data;

 1@@ -185,18 +185,16 @@ xs_dict *xs_multipart_form_data(const char *payload, int p_size, const char *hea
 2 
 3     /* iterate searching the boundaries */
 4     while ((p = xs_memmem(payload + offset, p_size - offset, boundary, bsz)) != NULL) {
 5-        xs *s1 = NULL;
 6-        xs *l1 = NULL;
 7-        const char *vn = NULL;
 8-        const char *fn = NULL;
 9-        const char *ct = NULL;
10+        xs *vn = NULL;
11+        xs *fn = NULL;
12+        xs *ct = NULL;
13         char *q;
14         int po, ps;
15 
16         /* final boundary? */
17         p += bsz;
18 
19-        if (p[0] == '-' && p[1] == '-')
20+        if ((p - payload) + 2 > p_size || (p[0] == '-' && p[1] == '-'))
21             break;
22 
23         /* skip the \r\n */
24@@ -205,9 +203,11 @@ xs_dict *xs_multipart_form_data(const char *payload, int p_size, const char *hea
25         /* Tokodon sends also a Content-Type headers,
26            let's use it to determine the file type */
27         do {
28-            if (p[0] == 13 && p[1] == 10)
29+            xs *s1 = NULL;
30+            xs *l1 = NULL;
31+            if (p[0] == '\r' && p[1] == '\n')
32                 break;
33-            q = strchr(p, '\r');
34+            q = memchr(p, '\r', p_size - (p - payload));
35 
36             /* unexpected formatting, fail immediately */
37             if (q == NULL)
38@@ -222,12 +222,12 @@ xs_dict *xs_multipart_form_data(const char *payload, int p_size, const char *hea
39                 l1 = xs_split(s1, "\"");
40 
41                 /* get the variable name */
42-                vn = xs_list_get(l1, 1);
43+                vn = xs_dup(xs_list_get(l1, 1));
44 
45                 /* is it an attached file? */
46                 if (xs_list_len(l1) >= 4 && strcmp(xs_list_get(l1, 2), "; filename=") == 0) {
47                     /* get the file name */
48-                    fn = xs_list_get(l1, 3);
49+                    fn = xs_dup(xs_list_get(l1, 3));
50                 }
51             }
52             else