From ba919280ac0e16f1d941226889caf2be6e535cb4 Mon Sep 17 00:00:00 2001
From: Erdnusschokolade <96622762+Erdnusschokolade@users.noreply.github.com>
Date: Sun, 24 May 2026 23:31:18 +0200
Subject: [PATCH] Address PR #233 review feedback

- itoa16_html: add comment that the function is sufficient for VLAN
  IDs (<=4094); generalization not needed.
- send_vlanlist: replace post-write bounds check with a pre-write
  guard using worst-case entry size (138 bytes + 1 for closing
  bracket). Old comment claimed ~45 bytes per entry, which only
  held for short names. With a 117-char name (the actual bound from
  CMD_BUF_SIZE) entries can reach 138 bytes, and the post-check
  would not have prevented an overflow.
- Document the 0x02 check in sfr_data[0] as the VLAN table entry
  valid flag.
---
 httpd/page_impl.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/httpd/page_impl.c b/httpd/page_impl.c
index cc1b98a..66b234e 100644
--- a/httpd/page_impl.c
+++ b/httpd/page_impl.c
@@ -97,7 +97,7 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }
 
-void itoa16_html(uint16_t v)
+void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
@@ -842,8 +842,9 @@ void send_cmd_log(void)
 
 void send_vlanlist(void)
 {
-	/* Worst case per entry: {"id":4094,"name":"<name>"}, ~45 bytes.
-	 * HTTP header ~50 bytes. TCP_OUTBUF_SIZE=2500 fits ~53 VLANs safely. */
+	/* Worst case per entry: {"id":4094,"name":"<117-char name>"} = 138 bytes
+	 * (name bound: CMD_BUF_SIZE=128 minus command prefix); +1 for closing ']'.
+	 * At worst case ~18 VLANs fit; typical configs with short names fit many more. */
 	__xdata uint16_t i;
 	__xdata uint16_t n;
 	uint8_t first = 1;
@@ -854,9 +855,12 @@ void send_vlanlist(void)
 	for (i = 1; i < 4095; i++) {
 		if (vlan_get(i) < 0)
 			continue;
-		if (!(sfr_data[0] & 0x02))
+		if (!(sfr_data[0] & 0x02)) /* bit 1: VLAN table entry valid */
 			continue;
 
+		if (slen + 139 > TCP_OUTBUF_SIZE) /* 138 bytes worst-case entry + 1 byte for closing ']' */
+			break;
+
 		if (!first)
 			char_to_html(',');
 		first = 0;
@@ -873,8 +877,6 @@ void send_vlanlist(void)
 
 		slen += strtox(outbuf + slen, "\"}");
 
-		if (slen > TCP_OUTBUF_SIZE - 60)
-			break;
 	}
 
 	char_to_html(']');