From b33745d104f3f67d1a3c4a7ba890efe2004286a7 Mon Sep 17 00:00:00 2001 From: Benedek Brandschott Date: Thu, 18 Jun 2026 16:02:37 +0200 Subject: [PATCH] fix(esp_http_server): report truncation when header value length matches buffer size httpd_req_get_hdr_value_str() detected truncation with `val_size < full_size`, where full_size is the strlcpy() return value. strlcpy() returns strlen() of the source (the terminating null is not counted), so truncation actually occurs when strlen(src) >= val_size. At strlen(src) == val_size the value is copied as val_size - 1 chars + NUL (i.e. truncated) yet ESP_OK was returned, so the caller never learned the value was cut. Use `val_size <= full_size` and correct the misleading comment about strlcpy()'s return value. Same truncation-reporting class fixed for httpd_cookie_key_value in PR #16202; httpd_req_get_hdr_value_str was missed. No memory-safety impact: strlcpy() null-terminates if val_size > 0. --- components/esp_http_server/src/httpd_parse.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/components/esp_http_server/src/httpd_parse.c b/components/esp_http_server/src/httpd_parse.c index 4ff3e1ca6b7..bde6612dfbc 100644 --- a/components/esp_http_server/src/httpd_parse.c +++ b/components/esp_http_server/src/httpd_parse.c @@ -1150,12 +1150,13 @@ esp_err_t httpd_req_get_hdr_value_str(httpd_req_t *r, const char *field, char *v } /* Get the NULL terminated value and copy it to the caller's buffer. - * Note `strlcpy()` will always return the size of the source string - * including terminating null. */ + * strlcpy() returns strlen() of the source string (the terminating + * null is NOT counted), so only val_size - 1 characters fit. */ size_t full_size = strlcpy(val, val_ptr, val_size); - /* If buffer length is smaller than needed, return truncation error */ - if (val_size < full_size) { + /* If the value did not fit in the buffer it was truncated, i.e. its + * length reached or exceeded val_size. Return truncation error. */ + if (val_size <= full_size) { return ESP_ERR_HTTPD_RESULT_TRUNC; } return ESP_OK;