From cefe48fe5125fca1c1712af8c5dd541084fe3231 Mon Sep 17 00:00:00 2001 From: bloqaudio Date: Mon, 24 Aug 2026 15:45:25 -0500 Subject: [PATCH] httpd: size the config upload buffer for a full config sector CONFIG_UPLOAD_BUF at 2560 capped a configuration upload at about 2.2K while the config sector holds 4K. Size the buffer as CONFIG_LEN plus room for the multipart framing so the whole sector is usable. config_take() wrote the payload without checking it against the sector: safe before only because the buffer could not hold an oversized one. Reject a payload that does not fit CONFIG_LEN, terminator included, instead of writing past the erased sector. --- httpd/httpd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index 3a54aca..ff4eff9 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -43,8 +43,9 @@ __xdata uint32_t cont_addr; __xdata uint8_t boundary[72]; // a client may split the request anywhere, including inside a boundary or a -// part header, so a configuration upload is parsed only once it is complete -#define CONFIG_UPLOAD_BUF 2560 +// part header, so a configuration upload is parsed only once it is complete; +// sized for a full config sector plus the multipart framing around it +#define CONFIG_UPLOAD_BUF (CONFIG_LEN + 384) __xdata uint8_t config_upload; __xdata uint8_t config_buf[CONFIG_UPLOAD_BUF]; __xdata uint16_t cfg_pos, cfg_hdr, cfg_body, cfg_end, cfg_last; @@ -364,6 +365,9 @@ static uint8_t config_take(void) while (cfg_hdr + 8 < cfg_body) { // the part carrying a filename holds the configuration if (strstart(&config_buf[cfg_hdr], "filename")) { + // the payload plus its terminator must fit the sector + if (cfg_end - cfg_body + 1 > CONFIG_LEN) + return 2; config_buf[cfg_end] = 0; flash_region.addr = CONFIG_START; flash_sector_erase();