From a77586fe54e321c7692d6acb1d6e30bd942d1381 Mon Sep 17 00:00:00 2001 From: Old-Ding Date: Mon, 6 Jul 2026 05:34:20 +0800 Subject: [PATCH] examples: xmlrpc: bound header value copy xmlrpc_handler() stores HTTP header values in a CONFIG_XMLRPC_STRINGSIZE + 1 byte buffer, but it passed CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE to xmlrpc_getheader(). With the defaults, that allows a 1024 byte copy into a 65 byte destination. Make xmlrpc_getheader() treat size as the destination capacity, reserve one byte for the terminator, and pass sizeof(value) from the caller. Signed-off-by: Old-Ding --- examples/xmlrpc/xmlrpc_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/examples/xmlrpc/xmlrpc_main.c b/examples/xmlrpc/xmlrpc_main.c index 0d90626e5eb..f170d7fc59a 100644 --- a/examples/xmlrpc/xmlrpc_main.c +++ b/examples/xmlrpc/xmlrpc_main.c @@ -134,6 +134,11 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char *header, FAR char *temp; int i = 0; + if (size <= 0) + { + return -1; + } + temp = strstr(buffer, header); if (temp) { @@ -150,7 +155,7 @@ static int xmlrpc_getheader(FAR char *buffer, FAR char *header, /* Copy the rest to the value parameter */ - while ((*temp != ' ') && (*temp != '\n') && (i < size)) + while ((*temp != ' ') && (*temp != '\n') && (i < size - 1)) { value[i++] = *temp++; } @@ -213,7 +218,7 @@ static void xmlrpc_handler(int fd) buffer[max] = 0; ret = xmlrpc_getheader(buffer, "Content-Length:", value, - CONFIG_EXAMPLES_XMLRPC_BUFFERSIZE); + sizeof(value)); if (ret > 0) loadlen = atoi(value); }