1 file changed, 16 insertions, 5 deletions
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index b62fc62..835e922 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -318,7 +318,7 @@ test_expect_success 'set up the advisory fixtures' '
 	write_script auth.sh <<-\EOF &&
 	case "$1" in
 	authenticate-post)
-		cat >/dev/null
+		wc -c >received
 		printf "Status: 302 Found\nLocation: /\n\n"
 		;;
 	esac
@@ -334,11 +334,22 @@ test_expect_success 'a newline in a file name cannot split the headers' '
 	grep "^Content-Disposition: inline; filename=.crlf\\\\r\\\\nX-Injected: 1.txt.$" tmp
 '
 
+# The body has to outgrow the 4096 byte buffer, or an unclamped read would
+# still stop at the end of the body and nothing would overflow. A length of
+# -1 reaches cgit as the largest number strtoul can return.
 test_expect_success 'a posted length past any buffer is clamped' '
-	echo "username=a&password=b" |
-	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=99999999999999 \
-		QUERY_STRING="p=login" cgit >tmp &&
-	grep "^Status: 302" tmp
+	test_seq 2000 >body &&
+	for length in 99999999999999 -1
+	do
+		rm -f received &&
+		CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=$length \
+			QUERY_STRING="p=login" cgit <body >tmp &&
+		test_grep "^Status: 302" tmp &&
+		test $(cat received) = 4096 || return 1
+	done &&
+	CGIT_CONFIG="$PWD/cverc" REQUEST_METHOD=POST CONTENT_LENGTH=10 \
+		QUERY_STRING="p=login" cgit <body >tmp &&
+	test $(cat received) = 10
 '
 
 test_expect_success 'the dumb transport refuses a path that climbs out' '