From 7d397983b0fee4412bfb1b0bd4416d25e3f89c23 Mon Sep 17 00:00:00 2001 From: Sean DuBois Date: Tue, 24 Sep 2024 10:20:15 -0400 Subject: [PATCH] Fix off-by-one/memory corruption in transport_ws Read doesn't take NULL terminator into account Resolves #14473 --- components/tcp_transport/transport_ws.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/tcp_transport/transport_ws.c b/components/tcp_transport/transport_ws.c index 2d4e416d17f..1de62e5b10e 100644 --- a/components/tcp_transport/transport_ws.c +++ b/components/tcp_transport/transport_ws.c @@ -285,7 +285,7 @@ static int ws_connect(esp_transport_handle_t t, const char *host, int port, int } int header_len = 0; do { - if ((len = esp_transport_read(ws->parent, ws->buffer + header_len, WS_BUFFER_SIZE - header_len, timeout_ms)) <= 0) { + if ((len = esp_transport_read(ws->parent, ws->buffer + header_len, WS_BUFFER_SIZE - header_len - 1, timeout_ms)) <= 0) { ESP_LOGE(TAG, "Error read response for Upgrade header %s", ws->buffer); return -1; }