Skip to content

IndexError: list assignment index out of range #122

Closed
@manunio

Description

@manunio

While fuzz testing #117 locally, it resulted in IndexError: list assignment index out of range error.

import io

from multipart import parse_form
from multipart.exceptions import FormParserError

TEST_DATA = b'----boundary\r\nContent-D----boundary\r\nContent-Disposition: form-data; name="file"; filename="test.t'


def on_field(field):
    print("field", field)


def on_file(file):
    print("file", file)


def main():
    header = {"Content-Type": "multipart/form-data; boundary=--boundary"}
    parse_form(header, io.BytesIO(TEST_DATA), on_field, on_file)


if __name__ == "__main__":
    main()
Traceback (most recent call last):
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/fuzz/test.py", line 23, in <module>
    main()
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/fuzz/test.py", line 19, in main
    parse_form(header, io.BytesIO(TEST_DATA), on_field, on_file)
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1954, in parse_form
    parser.write(buff)
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1844, in write
    return self.parser.write(data)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1128, in write
    l = self._internal_write(data, data_len)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1472, in _internal_write
    self.lookbehind[index - 1] = c
    ~~~~~~~~~~~~~~~^^^^^^^^^^^
IndexError: list assignment index out of range

caused by:

self.lookbehind[index - 1] = c

Tested against ed02d22

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions