Skip to content

fix: bound HTTP query parameters - #2242

Merged
SanderMertens merged 1 commit into
SanderMertens:masterfrom
ShiroKSH:fix/http-query-param-limit
Aug 3, 2026
Merged

fix: bound HTTP query parameters#2242
SanderMertens merged 1 commit into
SanderMertens:masterfrom
ShiroKSH:fix/http-query-param-limit

Conversation

@ShiroKSH

@ShiroKSH ShiroKSH commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Limit parsed query parameters to ECS_HTTP_QUERY_PARAM_COUNT_MAX.
  • Preserve the final accepted parameter when additional query fields are present.
  • Add HTTP regression coverage and regenerate the distribution source.

Root cause

The request parser recorded every query parameter although ecs_http_request_t::params is a fixed 32-entry array. Decoding a request with a 33rd field wrote past that array.

Testing

  • bake run test/addons -- Http.query_params_max
  • bake run test/addons --cfg sanitize -- Http.query_params_max
  • bake run test/addons -- Http
  • cmake --build /tmp/flecs-cmake-strict -j 4
  • clang -std=gnu99 -fsyntax-only -Werror -Wall -Wextra -Wno-unused-parameter -Wno-missing-field-initializers distr/flecs.c

@SanderMertens

Copy link
Copy Markdown
Owner

LGTM!

@SanderMertens
SanderMertens merged commit d03355e into SanderMertens:master Aug 3, 2026
71 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants