diff options
| author | hopehook <hopehook.com@gmail.com> | 2022-02-09 20:20:06 +0800 |
|---|---|---|
| committer | Ian Lance Taylor <iant@golang.org> | 2022-03-22 15:16:23 +0000 |
| commit | eca0d44cec58951fb716e540dcc21c0f527686d5 (patch) | |
| tree | be5e6f43ad048525121bccb244dc47f141d37dd0 | |
| parent | 96567fb3ccdc8d8c052606112db7b39abd725b59 (diff) | |
| download | go-eca0d44cec58951fb716e540dcc21c0f527686d5.tar.gz go-eca0d44cec58951fb716e540dcc21c0f527686d5.zip | |
net/http: fix nil body causing ParseMultipartForm to panic
ParseMultipartForm relies on a valid multipartReader, if the request body is nil,
the multipartReader should return an error. This way ParseMultipartForm can return
an error instead of causing mr.ReadForm(maxMemory) to panic
Fixes #48206
Change-Id: Ief906f2340c7ab29cacbd5f56892117202a0b911
Reviewed-on: https://go-review.googlesource.com/c/go/+/384454
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Trust: Brad Fitzpatrick <bradfitz@golang.org>
| -rw-r--r-- | src/net/http/request.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/net/http/request.go b/src/net/http/request.go index f8f1eeab29..dbe947aec4 100644 --- a/src/net/http/request.go +++ b/src/net/http/request.go @@ -480,6 +480,9 @@ func (r *Request) multipartReader(allowMixed bool) (*multipart.Reader, error) { if v == "" { return nil, ErrNotMultipart } + if r.Body == nil { + return nil, errors.New("missing form body") + } d, params, err := mime.ParseMediaType(v) if err != nil || !(d == "multipart/form-data" || allowMixed && d == "multipart/mixed") { return nil, ErrNotMultipart |