gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-08-30 14:52:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

httpd: size the config upload buffer for a full config sector

Browse Source 
CONFIG_UPLOAD_BUF at 2560 capped a configuration upload at about 2.2K
while the config sector holds 4K. Size the buffer as CONFIG_LEN plus
room for the multipart framing so the whole sector is usable.

config_take() wrote the payload without checking it against the sector:
safe before only because the buffer could not hold an oversized one.
Reject a payload that does not fit CONFIG_LEN, terminator included,
instead of writing past the erased sector.
This commit is contained in:
bloqaudio
2026-08-24 15:45:25 -05:00
parent e8e7fcbe7f
commit cefe48fe51
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httpd/httpd.c
+6 -2
View File
@@ -43,8 +43,9 @@ __xdata uint32_t cont_addr;
__xdata uint8_t boundary[72]; __xdata uint8_t boundary[72];
// a client may split the request anywhere, including inside a boundary or a // a client may split the request anywhere, including inside a boundary or a
// part header, so a configuration upload is parsed only once it is complete // part header, so a configuration upload is parsed only once it is complete;
#define CONFIG_UPLOAD_BUF 2560 // sized for a full config sector plus the multipart framing around it
#define CONFIG_UPLOAD_BUF (CONFIG_LEN + 384)
__xdata uint8_t config_upload; __xdata uint8_t config_upload;
__xdata uint8_t config_buf[CONFIG_UPLOAD_BUF]; __xdata uint8_t config_buf[CONFIG_UPLOAD_BUF];
__xdata uint16_t cfg_pos, cfg_hdr, cfg_body, cfg_end, cfg_last; __xdata uint16_t cfg_pos, cfg_hdr, cfg_body, cfg_end, cfg_last;
@@ -364,6 +365,9 @@ static uint8_t config_take(void)
while (cfg_hdr + 8 < cfg_body) { while (cfg_hdr + 8 < cfg_body) {
// the part carrying a filename holds the configuration // the part carrying a filename holds the configuration
if (strstart(&config_buf[cfg_hdr], "filename")) { if (strstart(&config_buf[cfg_hdr], "filename")) {
// the payload plus its terminator must fit the sector
if (cfg_end - cfg_body + 1 > CONFIG_LEN)
return 2;
config_buf[cfg_end] = 0; config_buf[cfg_end] = 0;
flash_region.addr = CONFIG_START; flash_region.addr = CONFIG_START;
flash_sector_erase(); flash_sector_erase();