mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-09-02 15:02:51 +08:00
bloqaudio
d6bf46595a
The digit loop accumulated into a uint16_t without a bound, so a query such as /vlan.json?vid=65540 read as VLAN 4 and every consumer saw a small, valid-looking number for an out-of-range one. Clamp the result at 0xffff once another digit would overflow (6552 * 10 + 9 is the last value that fits). The consumers already reject or mask 0xffff: vlan_get() refuses anything from 4095 up, send_l2() masks the index to the table size, and l2_delete() masks the high byte.