mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-06 08:35:21 +08:00
Martin Vogel
c8f3db2831
The UI handlers accumulate JSON with `pos += snprintf(buf + pos, size - pos, ...)`. snprintf returns the length it WOULD have written, so on truncation pos ran past the end of the buffer and the next call's `size - pos` wrapped to a huge value and wrote out of bounds — reachable through the directory browser, whose readdir entries can fill the buffer before the trailing parent/roots appends. Route every accumulator through a clamping http_appendf() helper that pins pos at the buffer size on truncation. Adds a forked-child regression test that browses a directory wide enough to fill the buffer. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>