Dear Maintainer,

   * What led up to the situation?

   If you upload a file via POST as "multipart/form-data" to a C++ program
compiled with libcgicc3, the transmitted file length is 2 bytes too short.


   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I have attached two files that can be used to reproduce the problem. The C++
file must be compiled with 'g++ test_file_upload_post_cgicc.cpp -lcgicc'. With
the attached perl test file you can trigger the problem. Then evaluate the
output of the debug.* files (generated by CGI) and compare it with the file that was uploaded. In
the Perl test this is 4bytes large.
I

   * What was the outcome of this action?

The file is shortened by 2 bytes, see debug.* files.

   * What outcome did you expect instead?

The file should have thesame length as original.


With best regards

Andreas

Dear Maintainer,

the fix is very easy:

The problem is the line 494 in Cgicc.cpp, the '-2' is wrong, because at end of file content there is no trailing \r\n. The comment in lin 492 is wrong, too.

The fix is easy:
--------------------------------------------
Index: cgicc/Cgicc.cpp
===================================================================
RCS file: /sources/cgicc/cgicc/cgicc/Cgicc.cpp,v
retrieving revision 1.34
diff -b -d -u -r1.34 Cgicc.cpp
--- cgicc/Cgicc.cpp 23 Apr 2014 20:55:04 -0000 1.34
+++ cgicc/Cgicc.cpp 23 Jul 2021 10:25:58 -0000
@@ -489,9 +489,9 @@
   if(std::string::npos == headLimit)
     throw std::runtime_error("Malformed input");

-  // Extract the value - there is still a trailing CR/LF to be subtracted off
+  // Extract the value
   std::string::size_type valueStart = headLimit + end.length();
-  std::string value = data.substr(valueStart, data.length() - valueStart - 2);
+  std::string value = data.substr(valueStart, data.length() -
+ valueStart);

   // Parse the header - pass trailing CR/LF x 2 to parseHeader
   MultipartHeader head = parseHeader(data.substr(0, valueStart));
--------------------------------------------

With best regards

Andreas
--
team member “long-term preservation“

Saxon State- and University Library Dresden (SLUB)
Department 2 (IT), Division 2.3 (infrastructure and digital long-term preservation)
Zellescher Weg 18 | 01069 Dresden
phone: +49 351 4677 763
E-Mail: Andreas.Romeyke@slub-dresden.de
http://www.slub-dresden.de/ | @slubdresden


Thank you for filing a new Bug report with Debian.

You can follow progress on this Bug here: 985941: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985941.

This is an automatically generated reply to let you know your message has been received.

Your message is being forwarded to the package maintainers and other interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 Chris Butler <chrisb@debian.org>

If you wish to submit further information on this problem, please send it to 985941@bugs.debian.org.

Please do not send mail to owner@bugs.debian.org unless you wish to report a problem with the Bug-tracking system.

Dear Maintainer,

there is a new upstream version, which fixes this issue. Please, could you integrate this critical patch in bookworm?

Here the link: http://ftp.gnu.org/gnu/cgicc/cgicc-3.2.20.tar.gz

With best regards

Andreas