ioLibrary_Driver
ioLibrary_Driver copied to clipboard
Code bug found
Dear WizNet developers,
I think I found a code bug in file Internet/httpServer/httpServer.c at line 149 onwards:
if ((len = getSn_RX_RSR(s)) > 0)
{
if (len > DATA_BUF_SIZE) len = DATA_BUF_SIZE;
len = recv(s, (uint8_t *)http_request, len);
*(((uint8_t *)http_request) + len) = '\0';
The bug is that the variable http_request contains a pointer to receive buffer with DATA_BUF_SIZE elements. So if len is set to DATA_BUF_SIZE then the last line would write to data which does not belong to http_request buffer. So it's an invalid memory write in essence.