Kludex / python-multipart

While fuzz testing #117 locally, it resulted in IndexError: list assignment index out of range error.

import io

from multipart import parse_form
from multipart.exceptions import FormParserError

TEST_DATA = b'----boundary\r\nContent-D----boundary\r\nContent-Disposition: form-data; name="file"; filename="test.t'


def on_field(field):
    print("field", field)


def on_file(file):
    print("file", file)


def main():
    header = {"Content-Type": "multipart/form-data; boundary=--boundary"}
    parse_form(header, io.BytesIO(TEST_DATA), on_field, on_file)


if __name__ == "__main__":
    main()

Traceback (most recent call last):
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/fuzz/test.py", line 23, in <module>
    main()
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/fuzz/test.py", line 19, in main
    parse_form(header, io.BytesIO(TEST_DATA), on_field, on_file)
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1954, in parse_form
    parser.write(buff)
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1844, in write
    return self.parser.write(data)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1128, in write
    l = self._internal_write(data, data_len)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/maxx/dev/security/oss-fuzz-projects/python-multipart-backup/venv/lib/python3.11/site-packages/multipart/multipart.py", line 1472, in _internal_write
    self.lookbehind[index - 1] = c
    ~~~~~~~~~~~~~~~^^^^^^^^^^^
IndexError: list assignment index out of range

caused by:

python-multipart/multipart/multipart.py

Line 1465 in ed02d22

self.lookbehind[index - 1] = c

Tested against ed02d22