curl_formget: fix FILE * leak

Properly deal with the fact that the last fread() call most probably is
a short read, and when using callbacks in fact all calls can be short
reads. No longer consider a file read done until it returns a 0 from the
read function.

Reported by: Aaron Orenstein
Bug: http://curl.haxx.se/mail/lib-2011-06/0048.html

1 files changed, 8 insertions, 3 deletions

diff --git a/lib/formdata.c b/lib/formdata.c
index 49e795453..5419371de 100644
--- a/lib/formdata.c
+++ b/lib/formdata.c
@@ -891,7 +891,7 @@ int curl_formget(struct curl_httppost *form, void *arg,
           Curl_formclean(&data);
           return -1;
         }
-      } while(nread == sizeof(buffer));
+      } while(nread);
     }
     else {
       if(ptr->length != append(arg, ptr->line, ptr->length)) {
@@ -1306,6 +1306,11 @@ static size_t readfromfile(struct Form *form, char *buffer,
       return 0;
     else
       nread = form->fread_func(buffer, 1, size, form->data->line);
+
+    if(nread > size)
+      /* the read callback can return a value larger than the buffer but
+         treat any such as no data in this case */
+      nread = 0;
   }
   else {
     if(!form->fp) {
@@ -1316,9 +1321,9 @@ static size_t readfromfile(struct Form *form, char *buffer,
     }
     nread = fread(buffer, 1, size, form->fp);
   }
-  if(!nread || nread > size) {
+  if(!nread) {
     /* this is the last chunk from the file, move on */
-    if(!callback) {
+    if(form->fp) {
       fclose(form->fp);
       form->fp = NULL;
     }