gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-08-30 14:52:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

httpd: send the config tail from the config sector, not a bare offset

Browse Source 
send_config() streams a configuration larger than the TCP output buffer
through the cont_addr/cont_len continuation, but set cont_addr to the
offset within the config instead of a flash address, so the tail was read
from code space. The file server sets cont_addr absolute; do the same by
adding CONFIG_START.

The bug was unreachable while CONFIG_UPLOAD_BUF capped uploads below
TCP_OUTBUF_SIZE, but a stored config near the full sector exposes it.
This commit is contained in:
bloqaudio
2026-08-24 15:45:25 -05:00
parent 772e9dc526
commit e8e7fcbe7f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httpd/page_impl.c
+1 -1
View File
@@ -822,7 +822,7 @@ found_end:
if (valid_len > (TCP_OUTBUF_SIZE - slen)) {
cont_len = valid_len - (TCP_OUTBUF_SIZE - slen);
valid_len = TCP_OUTBUF_SIZE - slen;
cont_addr = valid_len;
cont_addr = CONFIG_START + valid_len;
}
flash_region.addr = CONFIG_START;