From 5444540d821aad43e4b501dfd590689fcb886a8c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 30 Jul 2026 11:11:19 +0000 Subject: [PATCH] fix(gateway): reject oversized ASAP responses instead of truncating JSON Co-authored-by: esadrianno --- src/gateway/routes.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/gateway/routes.c b/src/gateway/routes.c index 514b60f..03540f3 100644 --- a/src/gateway/routes.c +++ b/src/gateway/routes.c @@ -618,7 +618,12 @@ static void handle_asap(http_server_ctx_t *ctx, const char *client_ip, *status = 200; { size_t rlen = strlen(resp_json); - if (rlen >= size) rlen = size - 1; + if (rlen >= size) { + free(resp_json); + jsonrpc_error(buf, size, status, 500, -32603, + "ASAP response exceeds gateway buffer"); + return; + } memcpy(buf, resp_json, rlen); buf[rlen] = '\0'; }