From d2e8ee0e412a27b9e01501a4ad787d4c130ac921 Mon Sep 17 00:00:00 2001
From: Priit Laes <plaes@plaes.org>
Date: Thu, 6 Aug 2026 15:24:09 +0300
Subject: [PATCH] httpd: Fix buffer offerflow in scan_header

Fixes #300
---
 httpd/httpd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/httpd/httpd.c b/httpd/httpd.c
index 7b90adf..561bd93 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -272,7 +272,8 @@ __xdata uint8_t *scan_header(__xdata uint8_t *p)
 		dbg_string("\nFound multipart\n");
 		content_type += 30;
 		uint8_t i = 0;
-		while (content_type[i] != '\r' && content_type[i] != '\n') {
+		while (i < (sizeof(boundary) - 5) &&
+				content_type[i] != '\r' && content_type[i] != '\n') {
 			boundary[i + 4] = content_type[i];
 			i++;
 		}