Ensure partial put data range not exceed ContentRange declared

Ensure write to bytes max to [end - start + 1], discard remaining part.
apache · Jan 22, 2025 · 5593c81 · 5593c81
1 parent d21f7e6
commit 5593c81
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/java/org/apache/catalina/servlets/DefaultServlet.java b/java/org/apache/catalina/servlets/DefaultServlet.java
@@ -689,10 +689,15 @@ protected File executePartialPut(HttpServletRequest req, ContentRange range, Str
             // Append data in request input stream to contentFile
             randAccessContentFile.seek(range.getStart());
             int numBytesRead;
+            long remainingBytes = range.getEnd() - range.getStart() + 1L;
             byte[] transferBuffer = new byte[BUFFER_SIZE];
             try (BufferedInputStream requestBufInStream = new BufferedInputStream(req.getInputStream(), BUFFER_SIZE)) {
-                while ((numBytesRead = requestBufInStream.read(transferBuffer)) != -1) {
+                while (remainingBytes > 0 && (numBytesRead = requestBufInStream.read(transferBuffer)) != -1) {
+                    if (numBytesRead > remainingBytes) {
+                        numBytesRead = (int) remainingBytes;
+                    }
                     randAccessContentFile.write(transferBuffer, 0, numBytesRead);
+                    remainingBytes -= numBytesRead;
                 }
             }
         }

diff --git a/test/org/apache/catalina/servlets/TestDefaultServletPut.java b/test/org/apache/catalina/servlets/TestDefaultServletPut.java
@@ -55,6 +55,9 @@ public static Collection<Object[]> parameters() {
                 "Content-Range: bytes 0-" + PATCH_LEN + "/" + START_LEN + CRLF, Boolean.TRUE, END_TEXT, Boolean.TRUE });
         parameterSets.add(new Object[] {
                 "Content-Range: ByTeS 0-" + PATCH_LEN + "/" + START_LEN + CRLF, Boolean.TRUE, END_TEXT, Boolean.TRUE });
+        // Valid partial PUT, only the first char is replaced.
+        parameterSets.add(new Object[] {
+                "Content-Range: ByTeS 0-" + 0 + "/" + START_LEN + CRLF, Boolean.TRUE, "Etarting text", Boolean.TRUE });
         // Full PUT
         parameterSets.add(new Object[] {
                 "", null, PATCH_TEXT, Boolean.TRUE });