[TW#24589] Out of bounds write in example http_perform_as_stream_reader

[Phaiax]

Environment

• Development Kit: [none]
• Core (if using chip or module): [ESP-WROOM32]
• IDF version: //c1fdd45 v3.1-beta1

Problem Description

The stream example in the file esp_http_client_example.c:

  char *buffer = malloc(MAX_HTTP_RECV_BUFFER); // Allocate buffer of size MAX_HTTP_RECV_BUFFER
  int content_length =  esp_http_client_fetch_headers(client); // Assume content_length == buffer size
  read_len = esp_http_client_read(client, buffer, content_length); // will return just the buffer size
  buffer[read_len] = 0;  // A trailing 0 byte is written to a position one after the last element of the array

Expected Behavior

Allocated buffer has size MAX_HTTP_RECV_BUFFER+1.
I like the idea of adding a zero byte for security reasons.

Actual Behavior

Out of bounds write if the server response body size matches the buffer size.

Also

The streaming example could be a real streaming example containing a while loop receiving data in chunks. Otherwise it is not really streaming.