HTTP multipart POST request alters file contents

Description

HTTP POST multipart processing converts bare CR or LF chars to CRLF pairs, corrupting most files when extracted with Files::ANALYZER_EXTRACT. This is clear in the attached gdb.log, which has a backtrace that shows a buffer with the start of a PDF file entering MIME/HTTP entity processing at frame 25, and emerging with LF chars converted to CRLF at frame 6.

Also attached are the pcap file associated with the backtrace, and an initial patch that we've barely begun to test. A point of concern with the patch is that it changes a weird.log entry from "line_terminated_with_single_CR" to "http_no_crlf_in_header_list". It does enable Files::ANALYZER_EXTRACT to correctly extract the PDF file from the attached pcap.

Please let me know if we can provide anything else to help with this.

Environment

CentOS 6.5, file extract analyzer

Assignee

Robin Sommer

Reporter

Brian O'Berry

Labels

None

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal
Configure