From 2574e765b5d74caa642d1bf4714da1f035a55e76 Mon Sep 17 00:00:00 2001
From: Carlos Garcia Campos <cgarcia@igalia.com>
Date: Mon, 19 Jan 2026 15:14:58 +0100
Subject: [PATCH] multipart: check length of bytes read
 soup_filter_input_stream_read_until()

We do make sure the read length is smaller than the buffer length when
the boundary is not found, but we should do the same when the boundary
is found.

Spotted in #YWH-PGM9867-149
Closes #493
---
 libsoup/soup-filter-input-stream.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
index 2c30bf984..d46bff20b 100644
--- a/libsoup/soup-filter-input-stream.c
+++ b/libsoup/soup-filter-input-stream.c
@@ -272,6 +272,7 @@ soup_filter_input_stream_read_until (SoupFilterInputStream  *fstream,
 	if (eof && !*got_boundary)
 		read_length = MIN (fstream->priv->buf->len, length);
 	else
-		read_length = p - buf;
+		read_length = MIN ((gsize)(p - buf), length);
+
 	return read_from_buf (fstream, buffer, read_length);
 }