From e8e7fcbe7fb2a46a5d8dc445a657b8d035e40789 Mon Sep 17 00:00:00 2001 From: bloqaudio Date: Mon, 24 Aug 2026 15:45:25 -0500 Subject: [PATCH] httpd: send the config tail from the config sector, not a bare offset send_config() streams a configuration larger than the TCP output buffer through the cont_addr/cont_len continuation, but set cont_addr to the offset within the config instead of a flash address, so the tail was read from code space. The file server sets cont_addr absolute; do the same by adding CONFIG_START. The bug was unreachable while CONFIG_UPLOAD_BUF capped uploads below TCP_OUTBUF_SIZE, but a stored config near the full sector exposes it. --- httpd/page_impl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd/page_impl.c b/httpd/page_impl.c index bf3e268..3e2e696 100644 --- a/httpd/page_impl.c +++ b/httpd/page_impl.c @@ -822,7 +822,7 @@ found_end: if (valid_len > (TCP_OUTBUF_SIZE - slen)) { cont_len = valid_len - (TCP_OUTBUF_SIZE - slen); valid_len = TCP_OUTBUF_SIZE - slen; - cont_addr = valid_len; + cont_addr = CONFIG_START + valid_len; } flash_region.addr = CONFIG_START;