Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Code bug found #129

Open
ulri-me opened this issue Jan 6, 2023 · 0 comments
Open

Code bug found #129

ulri-me opened this issue Jan 6, 2023 · 0 comments

Comments

@ulri-me
Copy link

ulri-me commented Jan 6, 2023

Dear WizNet developers,

I think I found a code bug in file Internet/httpServer/httpServer.c at line 149 onwards:

if ((len = getSn_RX_RSR(s)) > 0)
{
    if (len > DATA_BUF_SIZE) len = DATA_BUF_SIZE;
    len = recv(s, (uint8_t *)http_request, len);

    *(((uint8_t *)http_request) + len) = '\0';

The bug is that the variable http_request contains a pointer to receive buffer with DATA_BUF_SIZE elements.
So if len is set to DATA_BUF_SIZE then the last line would write to data which does not belong to http_request buffer.
So it's an invalid memory write in essence.

@ulri-me ulri-me closed this as completed Jan 6, 2023
@ulri-me ulri-me reopened this Jan 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant