uhttpd, branch master

client: use base-10 parsing for Content-Length header

2026-04-16T09:10:36Z

strtoul() with base 0 auto-detects octal (leading "0") and hexadecimal (leading "0x") prefixes. A Content-Length value like "025" was parsed as octal 21 instead of decimal 25. Since compliant HTTP frontends always parse Content-Length as decimal per RFC 7230, this mismatch enables HTTP request smuggling when uhttpd sits behind a reverse proxy or load balancer. Fix by explicitly passing base 10 to strtoul(). Reported-by: Nicola Staller Signed-off-by: Paul Spooren

ubus: unregister ubus subscriber on HTTP client disconnect

2025-12-24T10:08:44Z

Fixes a potential SIGSEGV when a client disconnects from a /ubus/subscribe/... endpoint without unsubscribing. The ubus subscriber is now properly unregistered in a cleanup handler, preventing callbacks on freed client structures. Fixes: #1 Signed-off-by: Tito Brasolin Link: https://github.com/openwrt/uhttpd/pull/18 Signed-off-by: Robert Marko

CMakeLists: update cmake minimum required version to 3.10

2025-10-03T21:39:09Z

New cmake version 4.0 requires at least 3.5 version as the minimum required version with it increased to 3.10 in to-be-released cmake versions. Set the minimum required version to 3.10 to future-proof for future cmake version. Suggested-by: Hannu Nyman Signed-off-by: Christian Marangi

client: Allow sending content in DONE state

2025-07-06T22:58:07Z

Allow sending content even when the connection is in done state. When we run into an error we will be in CLIENT_STATE_DONE state and have to write some content to the client. Allow writing in normal DATA and in DONE state. This fixes http error 403 in LuCI. Fixes: b3e3c05d6781 ("client: don't send stray EOF chunk on connection timeout") Signed-off-by: Hauke Mehrtens

client: reject requests with multiple content-lengths and/or TEs

2025-04-05T23:36:37Z

Add logic to reject requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers. Fixes: #8 Signed-off-by: Jo-Philipp Wich

file: prevent writes beyond end of uh_buf on enumerating directories

2025-04-05T13:21:52Z

Under some circumstances, e.g. when enumerating the entries of a directory hierarchy close to 4096 bytes total path length, the sprintf() used to conatenate the filename might write beyond the end of the PATH_MAX sized global `uh_buf` scratch buffer used to form the complete file paths during enumeration, potentially clobbering neighboring data structures, such as the global configuration struct. Prevent this issue by passing the amount of remaining available bytes for the name componentent to the `list_entries()` function and passing this value to `snprintf()` therein. Signed-off-by: Jo-Philipp Wich

proc: inhibit chunked transfer encoding on existing TEs or known length

2025-04-05T12:32:36Z

When a backend CGI, Lua or ucode handler produces a response which either includes a Content-Length or a Transfer-Encoding header then disable the uhttpd side chunked transfer encoding and assume the backend response to be already properly encoded or length delimitted. Fixes: https://github.com/openwrt/luci/issues/7655 Signed-off-by: Jo-Philipp Wich

client: don't send stray EOF chunk on connection timeout

2024-01-23T08:48:35Z

Ensure that any kind of chunk data is only sent when the client connection is in the body data state in order to avoid sending superfluous `0\r\n\r\n` chunks on closing idle connections. Signed-off-by: Jo-Philipp Wich

uhttpd/file: fix string out of buffer range on uh_defer_script

2023-06-25T17:24:45Z

if a url path length is multiple of 8, tailing zero will be trimed out on uh_defer_script, cause a strangle error. it's simple to reproduce. 1. create a luci controller, register a entry with path length multiple of 8 (including '/cgi-bin/'), for example, '/cgi-bin/luci/admin/system/admin'. 2. set uhttpd max_requests to 1, and restart uhttpd 3. request '/cgi-bin/luci/admin/system/admin' with at least 2 process 4. some responses will produce a error: ``` Unable to launch the requested CGI program: /www/cgi-bin/luci: No such file or directory ``` Signed-off-by: Liangbin Lian

mimetypes: add audio/video support for apple airplay

2023-01-28T16:10:36Z

Airplay of a statically hosted video file from one Apple device to another fails due to unrecognized content-type. Let's assume we have url1: http://openwrt.local/luci-static/video.mp4. If url1 is passed to a HTML5 browser, it will download the file instead of playing it back as it thinks it is a binary (no entry for mp4 extension atm). Let's also assume we worked this around by wrapping url1 in HTML5 video tag, inside of an html file which we will put at url2: http://openwrt.local/luci-static/video.html. The playback starts as the browser now knows it is a video. However, if we now wanted to send the video over Airplay to a second device, it's not gonna share the html file found at url2, but rather the video file found at url1, and the playback on second device will fail as it thinks it is a binary. Adding Airplay supported extensions/mime types fixes the issue. Signed-off-by: Sasha Andonov