From a0140c906e2d7afb172dadada6cc8dddf7483418 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Tue, 16 Jun 2026 15:45:45 +0800 Subject: [PATCH] fix(httpd): validate buf_len in httpd_req_get_url_query_str_ptr() --- components/esp_http_server/include/esp_http_server.h | 10 +++++----- components/esp_http_server/src/httpd_parse.c | 4 +++- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/components/esp_http_server/include/esp_http_server.h b/components/esp_http_server/include/esp_http_server.h index 9bfa653c0e6..01fd06df1f9 100644 --- a/components/esp_http_server/include/esp_http_server.h +++ b/components/esp_http_server/include/esp_http_server.h @@ -1065,17 +1065,17 @@ esp_err_t httpd_req_get_url_query_str(httpd_req_t *r, char *buf, size_t buf_len) * algorithm needs to be applied. * - This API is supposed to be called only from the context of * a URI handler where httpd_req_t* request pointer is valid - * - The byte range between buf and buf_len should only be used withing + * - The byte range between buf and buf_len should only be used within * the URI handler and not after since it will lead to use after free * errors * * @param[in] r The request being responded to - * @param[out] buf Pointer to a pointer that should be updated to the begin of - * the buffer - * @param[out] buf_len Pointer of length of output buffer + * @param[out] buf Pointer to a pointer that should be updated to the beginning of + * the query string within the request URL + * @param[out] buf_len Pointer to a length that will be updated with the query length * * @return - * - ESP_OK : Query is found in the request URL and copied to buffer + * - ESP_OK : Query found; *buf points to the query string and *buf_len holds its length * - ESP_FAIL : uri is empty * - ESP_ERR_NOT_FOUND : Query not found * - ESP_ERR_INVALID_ARG : Null arguments diff --git a/components/esp_http_server/src/httpd_parse.c b/components/esp_http_server/src/httpd_parse.c index 6c527ab830f..1d2058a71b4 100644 --- a/components/esp_http_server/src/httpd_parse.c +++ b/components/esp_http_server/src/httpd_parse.c @@ -1020,7 +1020,9 @@ esp_err_t httpd_req_get_url_query_str(httpd_req_t *r, char *buf, size_t buf_len) esp_err_t httpd_req_get_url_query_str_ptr(httpd_req_t *r, const char **buf, size_t *buf_len) { - if (r == NULL || buf == NULL) { + /* buf_len is an output pointer that is dereferenced below, so it must be + * validated along with the other arguments to avoid a NULL write */ + if (r == NULL || buf == NULL || buf_len == NULL) { return ESP_ERR_INVALID_ARG; }