ucode: clamp read length to the size of the static buffer

uc_uclient_read() reads into a fixed 4096-byte static buffer but passed
the caller-supplied length straight to uclient_read(). A script calling
read() with a length larger than 4096 (e.g. cl.read(100000)) against a
server that has that much data buffered makes uclient_http_read() memcpy
up to the requested length into the 4096-byte buffer, overflowing it.

Clamp the per-iteration read to sizeof(buf); the surrounding loop already
accumulates the requested amount across iterations. This also avoids the
size_t->int truncation when a length above INT_MAX is requested.

Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/uclient/pull/16
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 1 insertions, 1 deletions

diff --git a/ucode.c b/ucode.c
index 119969e..0232340 100644
--- a/ucode.c
+++ b/ucode.c
@@ -427,7 +427,7 @@ uc_uclient_read(uc_vm_t *vm, size_t nargs)
 		len = sizeof(buf);
 
 	while (len > 0) {
-		cur = uclient_read(cl, buf, len);
+		cur = uclient_read(cl, buf, len > sizeof(buf) ? sizeof(buf) : len);
 		if (cur <= 0)
 			break;