Aksal/nuttx-apps
1
0
Fork 1
mirror of https://github.com/apache/nuttx-apps.git synced 2026-08-01 20:29:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

examples: xmlrpc: bound header value copy

Browse source 
xmlrpc_handler() stores HTTP header values in a CONFIG_XMLRPC_STRINGSIZE + 1 byte buffer, but it passed CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE to xmlrpc_getheader(). With the defaults, that allows a 1024 byte copy into a 65 byte destination.

Make xmlrpc_getheader() treat size as the destination capacity, reserve one byte for the terminator, and pass sizeof(value) from the caller.

Signed-off-by: Old-Ding <ai.neo.ae86@gmail.com>
This commit is contained in:
Old-Ding 2026-07-06 05:34:20 +08:00 • committed by Xiang Xiao
parent 662133eeca
commit 54905cd0ff
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
examples/xmlrpc/xmlrpc_main.c
View file

@ -134,6 +134,11 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char *header,
FAR char *temp;
int i = 0;
if (size <= 0)
{
return -1;
}
temp = strstr(buffer, header);
if (temp)
{
@ -150,7 +155,7 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char *header,
/* Copy the rest to the value parameter */
while ((*temp != ' ') && (*temp != '\n') && (i < size))
while ((*temp != ' ') && (*temp != '\n') && (i < size - 1))
{
value[i++] = *temp++;
}
@ -213,7 +218,7 @@ static void xmlrpc_handler(int fd)
buffer[max] = 0;
ret = xmlrpc_getheader(buffer, "Content-Length:", value,
CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE);
sizeof(value));
if (ret > 0)
loadlen = atoi(value);
}