Aditya Patwardhan 984ea5ad81 fix(esp_http_server): reject Content-Length above UINT32_MAX ...

In httpd_parse.c, cb_headers_complete() converted the HTTP parser's
content_length (uint64_t) to the request's content_len (size_t) via an
unsafe cast through (int). On a 32-bit size_t target a Content-Length
above 4 GiB silently truncated, enabling request smuggling where the
server and an upstream proxy disagree on the body length (CWE-681).

Reject any Content-Length above UINT32_MAX with 413 Content Too Large
before any handler runs. UINT32_MAX is the largest body length the
server can represent in size_t content_len on every target, so this is
the maximum the server can support; no configuration knob is needed.

Closes SEC-102
Closes SEC-229

(cherry picked from commit 9d3f510c7f)

2026-09-02 17:19:39 +08:00

..

include

fix(ws): enforce payload length encoding minimality and MSB constraints

2026-08-27 16:50:25 +08:00

src

fix(esp_http_server): reject Content-Length above UINT32_MAX

2026-09-02 17:19:39 +08:00

test_apps

fix(ws): enforce payload length encoding minimality and MSB constraints

2026-08-27 16:50:25 +08:00

CMakeLists.txt

fix(esp_http_server): remove http server unused psa migration

2026-03-02 14:48:41 +08:00

Kconfig

fix(ws): enforce payload length encoding minimality and MSB constraints

2026-08-27 16:50:25 +08:00