From d6bf46595a514b6610736106709da89b2c18f44c Mon Sep 17 00:00:00 2001 From: bloqaudio Date: Mon, 31 Aug 2026 20:46:13 -0500 Subject: [PATCH] httpd: saturate parse_short() instead of wrapping The digit loop accumulated into a uint16_t without a bound, so a query such as /vlan.json?vid=65540 read as VLAN 4 and every consumer saw a small, valid-looking number for an out-of-range one. Clamp the result at 0xffff once another digit would overflow (6552 * 10 + 9 is the last value that fits). The consumers already reject or mask 0xffff: vlan_get() refuses anything from 4095 up, send_l2() masks the index to the table size, and l2_delete() masks the high byte. --- httpd/httpd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd/httpd.c b/httpd/httpd.c index 6227bb4..2701e64 100644 --- a/httpd/httpd.c +++ b/httpd/httpd.c @@ -231,7 +231,10 @@ uint8_t parse_short(__xdata uint8_t *p) c = *p++ - '0'; if (c > 9) { break; } err = 0; - short_parsed = (short_parsed * 10) + c; + if (short_parsed > 6552) + short_parsed = 0xffff; + else + short_parsed = (short_parsed * 10) + c; } return err; }