diff --git a/object-handlers.go b/object-handlers.go index c82bbf6fb..1b8bcc33b 100644 --- a/object-handlers.go +++ b/object-handlers.go @@ -741,6 +741,12 @@ func (api objectAPIHandlers) PutObjectPartHandler(w http.ResponseWriter, r *http return } + // check partID with maximum part ID for multipart objects + if isMaxPartID(partID) { + writeErrorResponse(w, r, ErrInvalidMaxParts, r.URL.Path) + return + } + var partMD5 string switch getRequestAuthType(r) { default: diff --git a/utils.go b/utils.go index ed42eaf4c..48cbe2dec 100644 --- a/utils.go +++ b/utils.go @@ -40,6 +40,8 @@ const ( maxObjectSize = 1024 * 1024 * 1024 * 5 // minimum Part size for multipart upload is 5MB minPartSize = 1024 * 1024 * 5 + // maximum Part ID for multipart upload is 10000 (Acceptable values range from 1 to 10000 inclusive) + maxPartID = 10000 ) // isMaxObjectSize - verify if max object size @@ -52,6 +54,11 @@ func isMinAllowedPartSize(size int64) bool { return size >= minPartSize } +// isMaxPartNumber - Check if part ID is greater than the maximum allowed ID. +func isMaxPartID(partID int) bool { + return partID > maxPartID +} + func contains(stringList []string, element string) bool { for _, e := range stringList { if e == element {