Blame SOURCES/apache-commons-fileupload-CVE-2014-0050.patch

d14097
diff --git a/src/main/java/org/apache/commons/fileupload/FileUploadBase.java b/src/main/java/org/apache/commons/fileupload/FileUploadBase.java
d14097
index b693744..c8f5ca1 100644
d14097
--- a/src/main/java/org/apache/commons/fileupload/FileUploadBase.java
d14097
+++ b/src/main/java/org/apache/commons/fileupload/FileUploadBase.java
d14097
@@ -991,7 +991,12 @@ public abstract class FileUploadBase {
d14097
             }
d14097
 
d14097
             notifier = new MultipartStream.ProgressNotifier(listener, requestSize);
d14097
-            multi = new MultipartStream(input, boundary, notifier);
d14097
+            try {
d14097
+                multi = new MultipartStream(input, boundary, notifier);
d14097
+            } catch (IllegalArgumentException iae) {
d14097
+                throw new InvalidContentTypeException(
d14097
+                        format("The boundary specified in the %s header is too long", CONTENT_TYPE), iae);
d14097
+            }
d14097
             multi.setHeaderEncoding(charEncoding);
d14097
 
d14097
             skipPreamble = true;
d14097
@@ -1183,7 +1188,7 @@ public abstract class FileUploadBase {
d14097
          * detail message.
d14097
          */
d14097
         public InvalidContentTypeException() {
d14097
-            // Nothing to do.
d14097
+            super();
d14097
         }
d14097
 
d14097
         /**
d14097
@@ -1196,6 +1201,9 @@ public abstract class FileUploadBase {
d14097
             super(message);
d14097
         }
d14097
 
d14097
+        public InvalidContentTypeException(String msg, Throwable cause) {
d14097
+            super(msg, cause);
d14097
+        }
d14097
     }
d14097
 
d14097
     /**
d14097
diff --git a/src/main/java/org/apache/commons/fileupload/MultipartStream.java b/src/main/java/org/apache/commons/fileupload/MultipartStream.java
d14097
index 9088947..0474ef9 100644
d14097
--- a/src/main/java/org/apache/commons/fileupload/MultipartStream.java
d14097
+++ b/src/main/java/org/apache/commons/fileupload/MultipartStream.java
d14097
@@ -268,10 +268,8 @@ public class MultipartStream {
d14097
     /**
d14097
      * Creates a new instance.
d14097
      *
d14097
-     * @deprecated 1.2.1 Use {@link #MultipartStream(InputStream, byte[],
d14097
-     * org.apache.commons.fileupload.MultipartStream.ProgressNotifier)},
d14097
-     * or {@link #MultipartStream(InputStream, byte[], int,
d14097
-     * org.apache.commons.fileupload.MultipartStream.ProgressNotifier)}
d14097
+     * @deprecated 1.2.1 Use {@link #MultipartStream(InputStream, byte[], int,
d14097
+     * ProgressNotifier)}
d14097
      */
d14097
     @Deprecated
d14097
     public MultipartStream() {
d14097
@@ -292,10 +290,8 @@ public class MultipartStream {
d14097
      *                 encapsulations.
d14097
      * @param bufSize  The size of the buffer to be used, in bytes.
d14097
      *
d14097
-     * @see #MultipartStream(InputStream, byte[],
d14097
-     *   MultipartStream.ProgressNotifier)
d14097
      * @deprecated 1.2.1 Use {@link #MultipartStream(InputStream, byte[], int,
d14097
-     *  org.apache.commons.fileupload.MultipartStream.ProgressNotifier)}.
d14097
+     * ProgressNotifier)}.
d14097
      */
d14097
     @Deprecated
d14097
     public MultipartStream(InputStream input, byte[] boundary, int bufSize) {
d14097
@@ -317,8 +313,7 @@ public class MultipartStream {
d14097
      * @param pNotifier The notifier, which is used for calling the
d14097
      *                  progress listener, if any.
d14097
      *
d14097
-     * @see #MultipartStream(InputStream, byte[],
d14097
-     *     MultipartStream.ProgressNotifier)
d14097
+     * @throws IllegalArgumentException If the buffer size is too small
d14097
      */
d14097
     MultipartStream(InputStream input,
d14097
             byte[] boundary,
d14097
@@ -331,9 +326,14 @@ public class MultipartStream {
d14097
 
d14097
         // We prepend CR/LF to the boundary to chop trailing CR/LF from
d14097
         // body-data tokens.
d14097
-        this.boundary = new byte[boundary.length + BOUNDARY_PREFIX.length];
d14097
         this.boundaryLength = boundary.length + BOUNDARY_PREFIX.length;
d14097
+        if (bufSize < this.boundaryLength + 1) {
d14097
+            throw new IllegalArgumentException(
d14097
+                    "The buffer size specified for the MultipartStream is too small");
d14097
+        }
d14097
+        this.boundary = new byte[this.boundaryLength];
d14097
         this.keepRegion = this.boundary.length;
d14097
+
d14097
         System.arraycopy(BOUNDARY_PREFIX, 0, this.boundary, 0,
d14097
                 BOUNDARY_PREFIX.length);
d14097
         System.arraycopy(boundary, 0, this.boundary, BOUNDARY_PREFIX.length,
d14097
@@ -352,8 +352,7 @@ public class MultipartStream {
d14097
      * @param pNotifier An object for calling the progress listener, if any.
d14097
      *
d14097
      *
d14097
-     * @see #MultipartStream(InputStream, byte[], int,
d14097
-     *     MultipartStream.ProgressNotifier)
d14097
+     * @see #MultipartStream(InputStream, byte[], int, ProgressNotifier)
d14097
      */
d14097
     MultipartStream(InputStream input,
d14097
             byte[] boundary,
d14097
@@ -368,10 +367,8 @@ public class MultipartStream {
d14097
      * @param boundary The token used for dividing the stream into
d14097
      *                 encapsulations.
d14097
      *
d14097
-     * @deprecated 1.2.1 Use {@link #MultipartStream(InputStream, byte[],
d14097
-     *  MultipartStream.ProgressNotifier)}.
d14097
-     * @see #MultipartStream(InputStream, byte[], int,
d14097
-     *  MultipartStream.ProgressNotifier)
d14097
+     * @deprecated 1.2.1 Use {@link #MultipartStream(InputStream, byte[], int,
d14097
+     *  ProgressNotifier)}.
d14097
      */
d14097
     @Deprecated
d14097
     public MultipartStream(InputStream input,
d14097
diff --git a/src/test/java/org/apache/commons/fileupload/MultipartStreamTest.java b/src/test/java/org/apache/commons/fileupload/MultipartStreamTest.java
d14097
index 7148d81..80871f4 100644
d14097
--- a/src/test/java/org/apache/commons/fileupload/MultipartStreamTest.java
d14097
+++ b/src/test/java/org/apache/commons/fileupload/MultipartStreamTest.java
d14097
@@ -38,7 +38,8 @@ public class MultipartStreamTest {
d14097
         final byte[] contents = strData.getBytes();
d14097
         InputStream input = new ByteArrayInputStream(contents);
d14097
         byte[] boundary = BOUNDARY_TEXT.getBytes();
d14097
-        int iBufSize = boundary.length;
d14097
+        int iBufSize =
d14097
+                boundary.length + MultipartStream.BOUNDARY_PREFIX.length + 1;
d14097
         MultipartStream ms = new MultipartStream(
d14097
                 input,
d14097
                 boundary,
d14097
@@ -47,6 +48,21 @@ public class MultipartStreamTest {
d14097
         assertNotNull(ms);
d14097
     }
d14097
 
d14097
+    @Test(expected=IllegalArgumentException.class)
d14097
+    public void testSmallBuffer() throws Exception {
d14097
+        final String strData = "foobar";
d14097
+        final byte[] contents = strData.getBytes();
d14097
+        InputStream input = new ByteArrayInputStream(contents);
d14097
+        byte[] boundary = BOUNDARY_TEXT.getBytes();
d14097
+        int iBufSize = 1;
d14097
+        @SuppressWarnings("unused")
d14097
+        MultipartStream ms = new MultipartStream(
d14097
+                input,
d14097
+                boundary,
d14097
+                iBufSize,
d14097
+                new MultipartStream.ProgressNotifier(null, contents.length));
d14097
+    }
d14097
+
d14097
     @Test
d14097
     public void testTwoParamConstructor() throws Exception {
d14097
         final String strData = "foobar";