From 43845b911b4c1ec113f5701f9f881f33d7774df7 Mon Sep 17 00:00:00 2001 From: d00f Date: Wed, 12 Aug 2026 03:22:01 +0200 Subject: [PATCH] httpd: stop the GET request line walk at the end of the buffer The POST path tests for a NUL before it looks at a byte. The GET path did not, and is_separator() counts only space, tab, question mark and equals, so a request line carrying none of those walks past the end of uip_buf and writes its terminator into whatever xdata it happens to stop on. Everything that is not a POST reaches that walk. The pointer advances past the method before anything checks that the method was GET, so a TLS record sent to port 80 by a browser trying https first is enough on its own, as is a port scanner or a malformed line. The stop is wherever the first space, tab, question mark or equals turns up in memory, which is why the symptoms are erratic. Two bytes of BANK1. BANK2 and xdata do not move. --- httpd/httpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index 561bd93..03b2d74 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -640,7 +640,7 @@ void httpd_appcall(void) p += 4; scan_header(p); __xdata uint8_t *q = p; - while (!is_separator(*p)) + while (*p && !is_separator(*p)) p++; *p = '\0'; dbg_string_x(q);