w-mj / httpserver Goto Github PK

Hawowo,

I found a buffa ovafwow in this code base Owo. The i-issue is with the spwintf (sprintf) caww in http.c on line 95. The spwintf uses two %s, with it being the diwectowy and the fiwe of whatevew fiwe it is wisting. The destinyation is a stack buffer, and there are nyot sufficient size checks to confirm an ovafwow will not happen (so it can). Thank youwu and have a nyice day!~ ☆*:.｡.o(≧▽≦)o.｡.:*☆