Reject invalid or out-of-range Content-Length


contentLength() narrowed toULongLong()'s result straight into a qint64,
so a Content-Length above the qsizetype maximum wrapped to a negative
value. That made the "bodyLength > 0" body-size gate in readHeader()
skip, and the request was routed to AllDone with no body consumed,
leaving the declared body on the wire to be parsed as the next request.
A non-numeric or negative Content-Length was likewise treated as "no
body" rather than rejected.

Validate the field: an absent Content-Length is still treated as no
body, but a value that is non-numeric, negative, or larger than a
QByteArray can hold cannot be a valid body length, so reject the
request with 400 (Bad Request). This is decided in contentLength()
before the body-size gate, so it does not depend on the configured
maximum body size.

[ChangeLog][QHttpServerParser] A request with a malformed
Content-Length (non-numeric, negative, or too large to represent)
is now rejected with 400 (Bad Request) over HTTP/1.Previously such
a value was ignored and the request processed as if it had no body.

Fixes: QTBUG-150275
Pick-to: 6.12 6.12.0
Change-Id: Ia2ac698bdd331509ea89b0a844ef4ce4c226a839
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Lena Biliaieva <lena.biliaieva@qt.io>
commit7573027a3f43ba88a8bba4497100dc2d260715bb
parent169d9bff54b2f2ab92d8e6f61c5d425cf27872f4
authorMate Barany <mate.barany@qt.io>
committerMate Barany <mate.barany@qt.io>
commit timeWed, 23 Sep 2026 19:08:12 +0000