From 68fd8af7b7ef39dc16c294471f31083a3b5033a8 Mon Sep 17 00:00:00 2001
From: Bar Hofesh <bar.hofesh@gmail.com>
Date: Thu, 29 Oct 2026 15:09:08 +0200
Subject: [PATCH] fix: add bounds check for boundary= value in
 MultipartStreamParser

When Content-Type ends exactly at "boundary=" with no value after it,
pos equals contentType.size() after the offset advance. The subsequent
contentType[pos] access reads one byte past the string, causing
undefined behavior (OOB read).

Add a pos >= contentType.size() guard that marks the parser invalid
and returns early, consistent with the other missing-boundary check
above it.

Fixes the remaining issue from GHSA-hv4q-wjv9-x524 (bug 1 of 3).
---
 lib/src/MultipartStreamParser.cc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/src/MultipartStreamParser.cc b/lib/src/MultipartStreamParser.cc
index 39486c9eb4..93081ca4aa 100644
--- a/lib/src/MultipartStreamParser.cc
+++ b/lib/src/MultipartStreamParser.cc
@@ -40,6 +40,11 @@ MultipartStreamParser::MultipartStreamParser(const std::string &contentType)
     }
 
     pos += boundaryEq.size();
+    if (pos >= contentType.size())
+    {
+        isValid_ = false;
+        return;
+    }
     size_t pos2;
     if (contentType[pos] == '"')
     {