From eb1e7c71e62028cc0599421b4e94be514d8afe0c Mon Sep 17 00:00:00 2001 From: pwsh <33337365+pwsh@users.noreply.github.com> Date: Mon, 12 Oct 2026 06:47:46 -0500 Subject: [PATCH] [WebUI] Fix dangling pointer when saving the gateway password (#2408) server.arg() returns a String by value, so the pointer from c_str() pointed into a temporary that was destroyed before strlen()/strcpy(). Co-authored-by: Claude Opus 5.5 --- main/webUI.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/main/webUI.cpp b/main/webUI.cpp index 134b09c..a19b8a4 100644 --- a/main/webUI.cpp +++ b/main/webUI.cpp @@ -898,12 +898,13 @@ void handleCG() { // HTML maxlength is client-side only — a direct POST can deliver any // length. Reject anything that would not fit (and leave dst // NUL-terminated) before copying into the fixed-size buffer. - const char* gp = server.arg("gp").c_str(); + // Keep the String alive: server.arg() returns a temporary. + String gp = server.arg("gp"); // ota_pass is extern char[] in this TU; size is parameters_size. - if (strlen(gp) >= parameters_size) { + if (gp.length() >= parameters_size) { THEENGS_LOG_WARNING(F("[WebUI] gateway password too long, ignoring" CR)); } else { - strcpy(ota_pass, gp); + strcpy(ota_pass, gp.c_str()); pwUpdate = true; } }