- handleAPIv1ToRadio: the toRadio handler memcpy'd a fixed 512 bytes
out of the request body regardless of its actual size. ulfius
allocates binary_body at exactly binary_body_length bytes and leaves
it NULL for a body-less PUT, so short bodies caused a heap overread
and empty ones dereferenced NULL. The unclamped length (ulfius
accepts up to 1024) was also handed to handleToRadio, reading past
the 512-byte stack buffer. Clamp both directions, matching the ESP32
ContentHandler behavior.
- callback_static_file: the stream-free callback only runs when
ulfius_set_stream_response succeeds, so the failure branch leaked the
FILE (and its fd) on every failed request. Close it and return 500.
- CheckSSLandLoad: free cert_pem before the missing-key return; the
constructor retries after regenerating certs and the reload
overwrote (leaked) the first buffer.
- generate_rsa_key / CreateSSLCertificate: free the EVP_PKEY_CTX,
EVP_PKEY, and X509 on their error returns; previously only the
success paths released them.
Ben Meadors
0739d2a68c