Fix CWE-190 - DoS could happen with a specially crafted boundary parameter in a multipart request

Author: mathieucarbou

src/ESPAsyncWebServer.h

@@ -465,7 +465,7 @@ class AsyncWebServerRequest {
   std::unordered_map<const char *, String, std::hash<const char *>, std::equal_to<const char *>> _attributes;
 
   uint8_t _multiParseState;
-  uint8_t _boundaryPosition;
+  size_t _boundaryPosition;
   size_t _itemStartIndex;
   size_t _itemSize;
   String _itemName;

src/WebRequest.cpp

@@ -476,6 +476,14 @@ bool AsyncWebServerRequest::_parseReqHeader() {
       if (value.startsWith(T_MULTIPART_)) {
         _boundary = value.substring(value.indexOf('=') + 1);
         _boundary.replace(String('"'), String());
+        // RFC 2046 §5.1 limits boundary strings to 70 characters.
+        // Reject invalid boundaries to prevent integer overflow in the parser.
+        if (_boundary.length() == 0 || _boundary.length() > 70) {
+          async_ws_log_d("Invalid multipart boundary length (%u), aborting", _boundary.length());
+          _parseState = PARSE_REQ_FAIL;
+          abort();
+          return true;
+        }
         _isMultipart = true;
       }
     } else if (name.equalsIgnoreCase(T_Content_Length) || name.equalsIgnoreCase(T_X_Expected_Entity_Length)) {
@@ -743,8 +751,7 @@ void AsyncWebServerRequest::_parseMultipartPostByte(uint8_t data, bool last) {
       itemWriteByte('\n');
       itemWriteByte('-');
       itemWriteByte('-');
-      uint8_t i;
-      for (i = 0; i < _boundaryPosition; i++) {
+      for (size_t i = 0; i < _boundaryPosition; i++) {
         itemWriteByte(_boundary.c_str()[i]);
       }
       _parseMultipartPostByte(data, last);