From c04a5fc3a41660700e215fce59eaa5781c207917 Mon Sep 17 00:00:00 2001 From: DrDoof <8052722+DrDoof@users.noreply.github.com> Date: Sat, 12 Sep 2026 16:24:15 +0200 Subject: [PATCH 1/7] flash: bail out of a bulk read of zero length flash_read_bulk() ends its copy loop only through the comparisons len == 1|2|3|4, so a length of zero matches none of them. The following len -= 4 wraps on uint16_t to 65532 and reaches 4 only after 16384 iterations, writing 65536 bytes to the destination and overwriting the whole XDATA space. send_config() gets there with valid_len 0 whenever the stored configuration begins with a NUL byte, which is the state left by uploading an empty configuration file. Every later request for the configuration page then clears the management VLAN and the STP flag and replaces the host address, while the switch keeps running and keeps forwarding traffic. --- rtl837x_flash.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rtl837x_flash.c b/rtl837x_flash.c index 5f04c88a..f18d21fb 100644 --- a/rtl837x_flash.c +++ b/rtl837x_flash.c @@ -222,6 +222,10 @@ void flash_read_jedecid(void) void flash_read_bulk(__xdata uint8_t *dst) { short status; + + if (!flash_region.len) + return; + flash_configure_sio(); while (flash_read_status() & STATUS_REG_BUSY_MASK); flash_configure_mmio(); From e0df37f359e6b2be8a7df8d9846f9cd03130511e Mon Sep 17 00:00:00 2001 From: DrDoof <8052722+DrDoof@users.noreply.github.com> Date: Sat, 12 Sep 2026 18:34:59 +0200 Subject: [PATCH 2/7] flash: bail out of a security-register read of zero length flash_read_security() ends its loop the same way flash_read_bulk() did before the previous commit: only through comparisons with 1, 2, 3 and 4. A length of zero matches none of them, the following subtraction wraps on uint16_t and the loop keeps printing until the counter comes back down to 4. No caller passes zero today, since the only one is the CLI with a constant length of 40, but the bound belongs in the function rather than in whoever calls it. --- rtl837x_flash.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rtl837x_flash.c b/rtl837x_flash.c index f18d21fb..3805d730 100644 --- a/rtl837x_flash.c +++ b/rtl837x_flash.c @@ -262,6 +262,9 @@ void flash_read_bulk(__xdata uint8_t *dst) void flash_read_security(void) { + if (!flash_region.len) + return; + flash_configure_sio(); while (flash_read_status() & STATUS_REG_BUSY_MASK); From 6ea9503ab24573d26147c60740277deae11f37b3 Mon Sep 17 00:00:00 2001 From: d00f <8052722+DrDoof@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:37:11 +0200 Subject: [PATCH 3/7] httpd: do not accept a session cookie before the first login session_id is cleared at boot and only a successful login fills it in, while the uptime counter and last_session_use both start at 0. For the first SESSION_TIMEOUT seconds after a start, a request carrying an empty "Cookie: session=" therefore passes is_word_x(session, session_id) and is treated as logged in, which is enough for /cmd, /config and /upload. Only look at the cookie once a session has been handed out. --- httpd/httpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index f87de897..74c11148 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -340,7 +340,7 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p) read_reg_timer(&now); - if (session) { + if (session && session_id[0]) { if (now - last_session_use > SESSION_TIMEOUT) { dbg_string("Session expired\n"); } else { From 3b3f36256c94c31125e31922eb064ed0ed1b95e5 Mon Sep 17 00:00:00 2001 From: d00f <8052722+DrDoof@users.noreply.github.com> Date: Tue, 15 Sep 2026 15:28:36 +0200 Subject: [PATCH 4/7] flash: drop the unused status variable from flash_read_bulk() Since #427 the busy wait calls flash_read_status() directly, so the local it used to go through is no longer read anywhere. --- rtl837x_flash.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/rtl837x_flash.c b/rtl837x_flash.c index 3805d730..2ec5bc3f 100644 --- a/rtl837x_flash.c +++ b/rtl837x_flash.c @@ -221,8 +221,6 @@ void flash_read_jedecid(void) */ void flash_read_bulk(__xdata uint8_t *dst) { - short status; - if (!flash_region.len) return; From 0cd56b11963b39839dd331e7d2bd9d3167392756 Mon Sep 17 00:00:00 2001 From: d00f <8052722+DrDoof@users.noreply.github.com> Date: Tue, 15 Sep 2026 19:27:50 +0200 Subject: [PATCH 5/7] ci: build pull requests too The workflow only ran on push, so a pull request opened from a fork never got a build, and neither did the host-side unit tests that run in the same job. --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1f859285..8fc36371 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -3,6 +3,7 @@ name: Build firmware on: push: branches: ['**'] + pull_request: jobs: build: From 8e78d1e629659ba7598d6373100d5f009c207ff4 Mon Sep 17 00:00:00 2001 From: bennydiamond Date: Mon, 14 Sep 2026 21:30:24 -0400 Subject: [PATCH 6/7] Missing closing bracket --- machine.c | 1 + 1 file changed, 1 insertion(+) diff --git a/machine.c b/machine.c index aeb8d5bc..1c2fee14 100644 --- a/machine.c +++ b/machine.c @@ -1182,6 +1182,7 @@ __code const struct machine machine = { 0 }, }, +}; #elif defined MACHINE_POE_2G080110GS __code const struct machine machine = { .machine_name = "MokerLink POE-2G080110GS", From 0d115e0e0bfaf26b4d50480f1883a3ff2c48e4f7 Mon Sep 17 00:00:00 2001 From: bennydiamond Date: Tue, 15 Sep 2026 15:34:34 -0400 Subject: [PATCH 7/7] Include HYWS-SGT0108S in makefile recipe 'machine_check' --- machine.h | 1 + 1 file changed, 1 insertion(+) diff --git a/machine.h b/machine.h index b6d4a825..14fc5c13 100644 --- a/machine.h +++ b/machine.h @@ -44,6 +44,7 @@ // #define MACHINE_SWTG024AS_V2_0 // #define MACHINE_FG_4GT_2SX_V2_0 // #define MACHINE_FG_8GT_1SX +// #define MACHINE_LIANGUO_HYWS_SGT0108S // #define MACHINE_POE_2G080110GS typedef struct {