Merge pull request #341 from DrDoof/fix/counters-port-index

httpd: check the port index /counters.json is given
This commit is contained in:
René van Dorst
2026-08-15 07:52:54 +00:00
committed by GitHub
+10 -1
View File
@@ -664,7 +664,16 @@ void httpd_appcall(void)
parse_short(q + 15);
send_vlan(short_parsed);
} else if (is_word(q, "/counters.json")) {
send_counters(q[20]-'0');
/* The port is one raw character of the request line and
* indexes a nine entry table, so bound it here instead
* of trusting the client to have sent a digit. Anything
* below '0' wraps well past eight, so the one test
* covers both ends. */
uint8_t cport = q[20] - '0';
if (cport > 8)
send_bad_request();
else
send_counters(cport);
} else if (is_word(q, "/eee.json")) {
send_eee();
} else if (is_word(q, "/bandwidth.json")) {