diff -rupN cgicc-3.2.16.orig/cgicc/Cgicc.cpp cgicc-3.2.16/cgicc/Cgicc.cpp --- cgicc-3.2.16.orig/cgicc/Cgicc.cpp 2014-04-23 22:55:04.000000000 +0200 +++ cgicc-3.2.16/cgicc/Cgicc.cpp 2018-07-04 22:24:43.623041226 +0200 @@ -441,7 +441,7 @@ cgicc::Cgicc::parseFormInput(const std:: break; // parse the data - parseMIME(data.substr(oldPos, pos - oldPos)); + parseMIME(data, oldPos, pos - oldPos); // update position oldPos = pos + sepLen; @@ -451,7 +451,7 @@ cgicc::Cgicc::parseFormInput(const std:: pos = data.find(sep2, oldPos); // parse the data, if found if(std::string::npos != pos) { - parseMIME(data.substr(oldPos, pos - oldPos)); + parseMIME(data, oldPos, pos - oldPos); } } } @@ -479,11 +479,11 @@ cgicc::Cgicc::parseHeader(const std::str } void -cgicc::Cgicc::parseMIME(const std::string& data) +cgicc::Cgicc::parseMIME(const std::string& data, std::string::size_type dataStart, std::string::size_type dataLen) { // Find the header std::string end = "\r\n\r\n"; - std::string::size_type headLimit = data.find(end, 0); + std::string::size_type headLimit = data.find(end, dataStart); // Detect error if(std::string::npos == headLimit) @@ -491,10 +491,10 @@ cgicc::Cgicc::parseMIME(const std::strin // Extract the value - there is still a trailing CR/LF to be subtracted off std::string::size_type valueStart = headLimit + end.length(); - std::string value = data.substr(valueStart, data.length() - valueStart - 2); + std::string value = data.substr(valueStart, dataLen - (valueStart-dataStart) - 2); // Parse the header - pass trailing CR/LF x 2 to parseHeader - MultipartHeader head = parseHeader(data.substr(0, valueStart)); + MultipartHeader head = parseHeader(data.substr(dataStart, valueStart-dataStart)); if(head.getFilename().empty()) fFormData.push_back(FormEntry(head.getName(), value)); diff -rupN cgicc-3.2.16.orig/cgicc/Cgicc.h cgicc-3.2.16/cgicc/Cgicc.h --- cgicc-3.2.16.orig/cgicc/Cgicc.h 2014-04-23 22:55:04.000000000 +0200 +++ cgicc-3.2.16/cgicc/Cgicc.h 2018-06-27 14:17:58.822860495 +0200 @@ -436,9 +436,9 @@ namespace cgicc { void parsePair(const std::string& data); - // Parse a MIME entry for ENCTYPE="" + // Parse a MIME entry for ENCTYPE="" from data.substr(dataStart,dataLen) void - parseMIME(const std::string& data); + parseMIME(const std::string& data, std::string::size_type dataStart, std::string::size_type dataLen); // Find elements in the list of entries bool