Skip to content

Fix null key dereference in post_iterator causing std::logic_error #375

Description

@judith-ipac

When MHD calls webserver::post_iterator() in src/webserver.cpp with off > 0 (a continuation chunk of a field), it may pass key = nullptr since the key was already provided in the first call. The fix introduced in commit 1b5fe8f added handling for off > 0 but did not guard against a null key before passing it to std::string, causing std::logic_error to be thrown, which propagates as an uncaught exception and terminates the process via std::terminate.

This was observed in production — under certain conditions we suspect MHD splits fields across multiple callbacks, triggering the null key path. The exact trigger is not fully understood but the fix is correct regardless: key should always be guarded before being passed to std::string.

The fix adds a single null check for key before both the continuation (off > 0) and initial (off == 0) cases:

if (!filename) {
    if (!key) {
        return MHD_YES;
    }
    if (off > 0) {
        mr->dhr->grow_last_arg(key, std::string(data, size));
        return MHD_YES;
    }
    mr->dhr->set_arg(key, std::string(data, size));
    return MHD_YES;
}

If key is null, we have no field name to store the value under — so there's nothing meaningful we can do with the data. Returning MHD_YES (silently skipping it) is the right behavior — it tells MHD "I processed this, continue" without trying to store anything. The alternative MHD_NO would abort the entire request.

This is similar to the null uri fix in uri_log (issue #371).

[Credit to Claude for diagnosis and write-up.]

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions