general/3334: End-of-line convention conversion for text/plain POST truncates data

[Larry Hastings <fu...@mpath.com>]

>Number:         3334
>Category:       general
>Synopsis:       End-of-line convention conversion for text/plain POST truncates data
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Mon Nov  2 19:40:00 PST 1998
>Last-Modified:
>Originator:     funkster@mpath.com
>Organization:
apache
>Release:        1.3.2
>Environment:
SunOS dionysus 5.5.1 Generic_103640-21 sun4m sparc SUNW,SPARCstation-20
>Description:
When an Apache web server receives a POST where the EOL convention is simply "\n" (rather than "\r\n"), and the submitted POST data is text/plain, it assumes the POST data requires "\n" -> "\r\n" conversion and converts it, adding a "\r" before every "\n".  But it does not adjust the "Content-Length:" accordingly.  Therefore, the content is truncated by N bytes, where N is the number of "\r"s added to the POST data.
>How-To-Repeat:
1) Install a simple "echo" CGI program that simply prints out its data.
2) POST to it with a header containing no "\r" characters.
>Fix:
Add one to the "Content-Length:" every time you add a "\r" to the POST data.  Eat more fresh fruits and vegetables.
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]