From beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 Mon Sep 17 00:00:00 2001 From: Stefano Babic Date: Thu, 19 Mar 2026 10:50:13 +0100 Subject: [PATCH] mongoose: Integer Underflow in Multipart Upload Parser The function mg_http_multipart_continue_wait_for_chunk() has a discrepancy between its guard condition and a subsequent subtraction in the else branch. The guard at line 250 checks `(int) io->len < mp_stream->boundary.len + 6`, allowing execution to continue when io->len >= boundary.len + 6. However, when mg_strstr() finds the boundary string in the buffer (else branch at line 264), data_len is computed as `io->len - (mp_stream->boundary.len + 8)`. The +6 vs +8 mismatch means that when io->len is in the range [boundary.len + 6, boundary.len + 7], the subtraction underflows the size_t variable to SIZE_MAX or SIZE_MAX - 1. This will fix CVE-2026-28525. Description of issue copied from vulnerability report - many thanks to Kazuma for his analyses. Signed-off-by: Stefano Babic Reported by: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc." Upstream: https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 CVE: CVE-2026-28525 Signed-off-by: Thomas Perale --- mongoose/mongoose_multipart.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mongoose/mongoose_multipart.c b/mongoose/mongoose_multipart.c index 12ea54348..7fdc18632 100644 --- a/mongoose/mongoose_multipart.c +++ b/mongoose/mongoose_multipart.c @@ -260,12 +260,12 @@ static int mg_http_multipart_continue_wait_for_chunk(struct mg_connection *c) { } return 0; } else { - size_t data_len = io->len - (mp_stream->boundary.len + 8); + size_t data_len = io->len - (mp_stream->boundary.len + 6); size_t consumed = mg_http_multipart_call_handler(c, MG_EV_HTTP_PART_DATA, - (char *) io->buf, data_len); + (char *) io->buf, data_len); mg_iobuf_del(io, 0, consumed); if (consumed == data_len) { - mg_iobuf_del(io, 0, mp_stream->boundary.len + 8); + mg_iobuf_del(io, 0, mp_stream->boundary.len + 6); mp_stream->state = MPS_FINALIZE; return 1; } else {