diff options
Diffstat (limited to 'src/mime/multipart/formdata.go')
| -rw-r--r-- | src/mime/multipart/formdata.go | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/src/mime/multipart/formdata.go b/src/mime/multipart/formdata.go index 3f6ff697ca6..4f26aab2cf4 100644 --- a/src/mime/multipart/formdata.go +++ b/src/mime/multipart/formdata.go @@ -12,6 +12,7 @@ import ( "math" "net/textproto" "os" + "strconv" ) // ErrMessageTooLarge is returned by ReadForm if the message form @@ -41,6 +42,15 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { numDiskFiles := 0 multipartFiles := godebug.Get("multipartfiles") combineFiles := multipartFiles != "distinct" + maxParts := 1000 + multipartMaxParts := godebug.Get("multipartmaxparts") + if multipartMaxParts != "" { + if v, err := strconv.Atoi(multipartMaxParts); err == nil && v >= 0 { + maxParts = v + } + } + maxHeaders := maxMIMEHeaders() + defer func() { if file != nil { if cerr := file.Close(); err == nil { @@ -86,13 +96,17 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { } var copyBuf []byte for { - p, err := r.nextPart(false, maxMemoryBytes) + p, err := r.nextPart(false, maxMemoryBytes, maxHeaders) if err == io.EOF { break } if err != nil { return nil, err } + if maxParts <= 0 { + return nil, ErrMessageTooLarge + } + maxParts-- name := p.FormName() if name == "" { @@ -136,6 +150,9 @@ func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) { if maxMemoryBytes < 0 { return nil, ErrMessageTooLarge } + for _, v := range p.Header { + maxHeaders -= int64(len(v)) + } fh := &FileHeader{ Filename: filename, Header: p.Header, |