Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(httpd): validate buf_len in httpd_req_get_url_query_str_ptr()

Browse Source
This commit is contained in:
Ashish Sharma
2026-06-16 15:45:45 +08:00
parent 11897b8d4e
commit a0140c906e
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
components/esp_http_server/include/esp_http_server.h
View File

@@ -1065,17 +1065,17 @@ esp_err_t httpd_req_get_url_query_str(httpd_req_t *r, char *buf, size_t buf_len)
* algorithm needs to be applied.
* - This API is supposed to be called only from the context of
* a URI handler where httpd_req_t* request pointer is valid
* - The byte range between buf and buf_len should only be used withing
* - The byte range between buf and buf_len should only be used within
* the URI handler and not after since it will lead to use after free
* errors
*
* @param[in] r The request being responded to
* @param[out] buf Pointer to a pointer that should be updated to the begin of
* the buffer
* @param[out] buf_len Pointer of length of output buffer
* @param[out] buf Pointer to a pointer that should be updated to the beginning of
* the query string within the request URL
* @param[out] buf_len Pointer to a length that will be updated with the query length
*
* @return
* - ESP_OK : Query is found in the request URL and copied to buffer
* - ESP_OK : Query found; *buf points to the query string and *buf_len holds its length
* - ESP_FAIL : uri is empty
* - ESP_ERR_NOT_FOUND : Query not found
* - ESP_ERR_INVALID_ARG : Null arguments

4
components/esp_http_server/src/httpd_parse.c
View File

@@ -1020,7 +1020,9 @@ esp_err_t httpd_req_get_url_query_str(httpd_req_t *r, char *buf, size_t buf_len)
esp_err_t httpd_req_get_url_query_str_ptr(httpd_req_t *r, const char **buf, size_t *buf_len)
{
if (r == NULL || buf == NULL) {
/* buf_len is an output pointer that is dereferenced below, so it must be
* validated along with the other arguments to avoid a NULL write */
if (r == NULL || buf == NULL || buf_len == NULL) {
return ESP_ERR_INVALID_ARG;
}