[WebUI] Fix dangling pointer when saving the gateway password (#2408)

server.arg() returns a String by value, so the pointer from c_str()
pointed into a temporary that was destroyed before strlen()/strcpy().

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
pwshandClaude Opus 5.5 authored and GitHub committed 2026-10-12 06:47:46 -05:00
1 parent 9795527b34
commit eb1e7c71e6
1 file changed
+4 -3
+4 -3
View File
@@ -898,12 +898,13 @@ void handleCG() {
// HTML maxlength is client-side only — a direct POST can deliver any
// length. Reject anything that would not fit (and leave dst
// NUL-terminated) before copying into the fixed-size buffer.
const char* gp = server.arg("gp").c_str();
// Keep the String alive: server.arg() returns a temporary.
String gp = server.arg("gp");
// ota_pass is extern char[] in this TU; size is parameters_size.
if (strlen(gp) >= parameters_size) {
if (gp.length() >= parameters_size) {
THEENGS_LOG_WARNING(F("[WebUI] gateway password too long, ignoring" CR));
} else {
strcpy(ota_pass, gp);
strcpy(ota_pass, gp.c_str());
pwUpdate = true;
}
}