httpd: Fix buffer offerflow in scan_header

Fixes #300
2026-08-30 14:52:51 +08:00 · 2026-08-06 15:24:09 +03:00
parent de3eca26c3
commit d2e8ee0e41
1 changed files with 2 additions and 1 deletions
@@ -272,7 +272,8 @@ __xdata uint8_t *scan_header(__xdata uint8_t *p)
 		dbg_string("\nFound multipart\n");
 		content_type += 30;
 		uint8_t i = 0;
-		while (content_type[i] != '\r' && content_type[i] != '\n') {
+		while (i < (sizeof(boundary) - 5) &&
+				content_type[i] != '\r' && content_type[i] != '\n') {
 			boundary[i + 4] = content_type[i];
 			i++;
 		}