Index: main/http.c =================================================================== --- main/http.c (revision 376198) +++ main/http.c (working copy) @@ -622,6 +622,7 @@ int content_length = 0; struct ast_variable *v, *post_vars=NULL, *prev = NULL; char *buf, *var, *val; + int res; for (v = headers; v; v = v->next) { if (!strcasecmp(v->name, "Content-Type")) { @@ -634,20 +635,28 @@ for (v = headers; v; v = v->next) { if (!strcasecmp(v->name, "Content-Length")) { - content_length = atoi(v->value) + 1; + content_length = atoi(v->value); break; } } - if (!content_length) { + if (content_length <= 0) { return NULL; } - buf = ast_alloca(content_length); - if (!fgets(buf, content_length, ser->f)) { + buf = ast_malloc(content_length + 1); + if (!buf) { return NULL; } + res = fread(buf, 1, content_length, ser->f); + if (res < content_length) { + /* Error, distinguishable by ferror() or feof(), but neither + * is good. */ + goto done; + } + buf[content_length] = '\0'; + while ((val = strsep(&buf, "&"))) { var = strsep(&val, "="); if (val) { @@ -665,6 +674,9 @@ prev = v; } } + +done: + ast_free(buf); return post_vars; }