mbed_controller / HTTPD

HTTPD bug fix which is caused by stack overflow.

Dependents:   mbed_controller_demo

Fork of HTTPD by Suga koubou

Original HTTPD implementation of Suga koubou is great but has some bug inside unfortunately. The most critical bug was accessing buffer with the index of out of range like following.

problematic code

char buf[256];

n = httpd->_state[id].client->receive(buf, sizeof(buf));
buf[n] =0;

With above code, it could set buf[256] = 0 when more that 255 data is received. Setting buf[256] causes some other area of memory is corrupted so that system can be predictive status since than.

bug fixed code

n = httpd->_state[id].client->receive(buf, sizeof(buf)-1);
buf[n] =0;

Diff: HTTPD.cpp

Revision:
2:584ce0a1a76e
Parent:
1:a4c4bd58dd3b
--- a/HTTPD.cpp	Fri Mar 20 12:08:16 2015 +0000
+++ b/HTTPD.cpp	Fri Apr 10 09:04:38 2015 +0000
@@ -18,11 +18,20 @@
 
 #include "HTTPD.h"
 
-// There was Hard Fault error in HTTPD with Seeed Arch Max platform
-// because of stack overflow.
-// According to the Callgraph report generated by Keil MDK 4.1,
-// the Max Depth of HTTPD::daemon() is 424 bytes.
+/*
+// There was hald fault error of HTTPD with Seeed Arch Max platform
+// because of stack overwritten.
+// According to the Callgraph report of Keil MDK 4.1,
+// the Max Depth is 424 bytes.
+HTTPD::daemon(const void*) (Thumb, 110 bytes, Stack size 0 bytes, httpd.o(.text)) 
 
+[Stack]
+
+Max Depth = 424 + Unknown Stack Size
+Call Chain = HTTPD::daemon(const void*) <-> TCPSocketServer::accept(TCPSocketConnection&) <->
+Socket::wait_readable(TimeInterval&) <-> Socket::select(timeval*, bool, bool) <->
+lwip_select <-> lwip_selscan <-> sys_arch_unprotect <-> error <-> exit (Cycle)
+*/
 #define DAEMON_STACK_SIZE   512
 
 HTTPD * HTTPD::_inst;
@@ -98,7 +107,7 @@
         for (;;) {
             if (! httpd->_state[id].client->is_connected()) break;
 
-            n = httpd->_state[id].client->receive(buf, sizeof(buf));
+            n = httpd->_state[id].client->receive(buf, sizeof(buf)-1);
             if (n < 0) break;
             buf[n] = 0;
 //            DBG("Recv %d '%s'", n, buf);
@@ -124,4 +133,3 @@
         INFO("Close %s\r\n", httpd->_state[id].client->get_address());
     }
 }
-