From 6792db21dc32bff90330945f0dd303bd490517cb Mon Sep 17 00:00:00 2001
From: chrislu <chris.lu@gmail.com>
Date: Thu, 17 Aug 2023 00:51:42 -0700
Subject: [PATCH] ErrInvalidPart when completed parts has extra parts

fix https://github.com/seaweedfs/seaweedfs/discussions/4746
---
 weed/s3api/filer_multipart.go | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/weed/s3api/filer_multipart.go b/weed/s3api/filer_multipart.go
index 3cf0971f6..f8027c7ee 100644
--- a/weed/s3api/filer_multipart.go
+++ b/weed/s3api/filer_multipart.go
@@ -90,6 +90,25 @@ func (s3a *S3ApiServer) completeMultipartUpload(input *s3.CompleteMultipartUploa
 		return nil, s3err.ErrNoSuchUpload
 	}
 
+	// check whether completedParts is more than received parts
+	{
+		partNumbers := make(map[int]struct{}, len(entries))
+		for _, entry := range entries {
+			if strings.HasSuffix(entry.Name, ".part") && !entry.IsDirectory {
+				partNumberString := entry.Name[:len(entry.Name)-len(".part")]
+				partNumber, err := strconv.Atoi(partNumberString)
+				if err == nil {
+					partNumbers[partNumber] = struct{}{}
+				}
+			}
+		}
+		for _, part := range completedParts {
+			if _, found := partNumbers[part.PartNumber]; !found {
+				return nil, s3err.ErrInvalidPart
+			}
+		}
+	}
+
 	mime := pentry.Attributes.Mime
 
 	var finalParts []*filer_pb.FileChunk