This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
The following commit(s) were added to refs/heads/master by this push:
new 54905cd0f examples: xmlrpc: bound header value copy
54905cd0f is described below
commit 54905cd0ffcce1a9f0416b5a8cb98c5f55d7538c
Author: Old-Ding <[email protected]>
AuthorDate: Mon Jul 6 05:34:20 2026 +0800
examples: xmlrpc: bound header value copy
xmlrpc_handler() stores HTTP header values in a CONFIG_XMLRPC_STRINGSIZE +
1 byte buffer, but it passed CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE to
xmlrpc_getheader(). With the defaults, that allows a 1024 byte copy into a 65
byte destination.
Make xmlrpc_getheader() treat size as the destination capacity, reserve one
byte for the terminator, and pass sizeof(value) from the caller.
Signed-off-by: Old-Ding <[email protected]>
---
examples/xmlrpc/xmlrpc_main.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/examples/xmlrpc/xmlrpc_main.c b/examples/xmlrpc/xmlrpc_main.c
index 0d90626e5..f170d7fc5 100644
--- a/examples/xmlrpc/xmlrpc_main.c
+++ b/examples/xmlrpc/xmlrpc_main.c
@@ -134,6 +134,11 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char
*header,
FAR char *temp;
int i = 0;
+ if (size <= 0)
+ {
+ return -1;
+ }
+
temp = strstr(buffer, header);
if (temp)
{
@@ -150,7 +155,7 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char
*header,
/* Copy the rest to the value parameter */
- while ((*temp != ' ') && (*temp != '\n') && (i < size))
+ while ((*temp != ' ') && (*temp != '\n') && (i < size - 1))
{
value[i++] = *temp++;
}
@@ -213,7 +218,7 @@ static void xmlrpc_handler(int fd)
buffer[max] = 0;
ret = xmlrpc_getheader(buffer, "Content-Length:", value,
- CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE);
+ sizeof(value));
if (ret > 0)
loadlen = atoi(value);
}
