From cbcf67a6939439ec0f6dd31327a71fb8e0944701 Mon Sep 17 00:00:00 2001 From: bloqaudio Date: Mon, 31 Aug 2026 20:46:13 -0500 Subject: [PATCH] httpd: keep scan_header() on the terminator of a truncated header The scan stepped over the NUL that ends the received data before breaking, so on a request whose headers were cut short it returned a pointer one past the data. handle_post() then tested that byte for the end of the header, reading whatever an earlier packet had left there instead of the NUL the appcall wrote, and could go on to run an endpoint against the stale bytes. Break before advancing so the returned pointer sits on the NUL and the caller's check sees it. --- httpd/httpd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index 2701e64..e063a47 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -277,8 +277,9 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p) while (!strstart(p, "\r\n\r\n")) { dbg_char(*p); - if (!*p++) + if (!*p) break; + p++; if ((v = header_value(p, "\ncontent-type:"))) content_type = v; else if ((v = header_value(p, "\ncookie:"))) {