The JavaScript for the POST is
file = document.getElementById("upfName").files[0];
xhrObj = new XMLHttpRequest();
xhrObj.open("POST", llm.serverExe + '?dataUpload', true);
xhrObj.setRequestHeader("Content-type", file.type);
xhrObj.setRequestHeader("X_FILE_NAME", file.name);
xhrObj.send(file);
The cgi side in C++ is
int iLen = atoi(getenv("HTTP_CONTENT_LENGTH"));
char* pBuff = <<allocates iLen bytes>>
read(0, pBuff, iLen);
If I send about 100k of text (about 10k short lines), iLen is correct but there is only about 10k of data and the last part of it is garbled (after about 1000 lines it starts showing at about line 900 again, shows 100 lines and then 90k of nothing)
It was a stupid attack.
1) You need to read in a loop to get all of the data, the read with return with ‘partial’ data.
2) You need to change the file mode of stdin to binary on windows for the count to be correct if the data is text. Otherwise the read removes carrage-returns making the data size smaller. Then since there is less data than you expect, the read will eventually just not return (stdin will not return an EOF, it just hangs).
All better now.