mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-08-30 14:52:51 +08:00
send_config() streams a configuration larger than the TCP output buffer through the cont_addr/cont_len continuation, but set cont_addr to the offset within the config instead of a flash address, so the tail was read from code space. The file server sets cont_addr absolute; do the same by adding CONFIG_START. The bug was unreachable while CONFIG_UPLOAD_BUF capped uploads below TCP_OUTBUF_SIZE, but a stored config near the full sector exposes it.