diff options
| author | Andy Chiang | 2026-05-18 09:40:28 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-05-20 00:44:00 +0000 |
| commit | 6ab9abb56bcb28684f382f7a94c170fad02348ea (patch) | |
| tree | 8c8486842b0c5c26698ed0f154c547c7982dda3f | |
| parent | 6fadf0da50509a510ac4f85d2adb70a83de2e1fc (diff) | |
| download | uhttpd-6ab9abb56bcb28684f382f7a94c170fad02348ea.tar.gz | |
cgi, file: fix crash due to field_len type mismatch with libubox
In libubox commit https://github.com/openwrt/libubox/commit/9b488010c4a74202a85ed24e01108fe069bd42e4,
the type of `alloc_len` in `calloc_a` was changed to `size_t`.
Since uhttpd still defined `field_len` as returning `int`, this type mismatch caused uhttpd to crash.
So change `field_len` type to `size_t` and add NULL check.
Fixes: https://github.com/openwrt/luci/issues/8629
Fixes: https://github.com/openwrt/libubox/pull/45
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/uhttpd/pull/24
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | cgi.c | 6 | ||||
| -rw-r--r-- | file.c | 10 |
2 files changed, 15 insertions, 1 deletions
@@ -31,6 +31,12 @@ void uh_interpreter_add(const char *ext, const char *path) in = calloc_a(sizeof(*in), &new_ext, strlen(ext) + 1, &new_path, strlen(path) + 1); + if (!in) { + fprintf(stderr, + "uhttpd: OOM while adding CGI interpreter (%s -> %s)\n", + ext, path); + return; + } in->ext = strcpy(new_ext, ext); in->path = strcpy(new_path, path); @@ -793,7 +793,7 @@ uh_free_pending_request(struct client *cl) free(dr); } -static int field_len(const char *ptr) +static size_t field_len(const char *ptr) { if (!ptr) return 0; @@ -821,6 +821,10 @@ uh_defer_script(struct client *cl, struct dispatch_handler *d, char *url, struct #undef _field #define _field(_name) &_##_name, field_len(pi->_name), dr = calloc_a(sizeof(*dr), &_url, strlen(url) + 1, path_info_fields NULL); + if (!dr) { + uh_client_error(cl, 500, "Internal Server Error", "Out of memory"); + return; + } memcpy(&dr->pi, pi, sizeof(*pi)); dr->path = true; @@ -831,6 +835,10 @@ uh_defer_script(struct client *cl, struct dispatch_handler *d, char *url, struct path_info_fields } else { dr = calloc_a(sizeof(*dr), &_url, strlen(url) + 1, NULL); + if (!dr) { + uh_client_error(cl, 500, "Internal Server Error", "Out of memory"); + return; + } } cl->dispatch.req_data = dr; |