From 07e580d9564d418c4a59cd221489df93cc8900b6 Mon Sep 17 00:00:00 2001
From: robert <ubuntu@ubuntu-2204.linuxvmimages.local>
Date: Fri, 21 Aug 2026 15:07:11 +0300
Subject: [PATCH] Check header table bounds

---
 mongoose.c       |  6 ++++++
 src/http.c       |  6 ++++++
 test/unit_test.c | 15 +++++++++++++--
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/mongoose.c b/mongoose.c
index 010d10b9..cdbc7b62 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -3862,6 +3862,12 @@ static bool mg_http_parse_headers(const char *s, const char *end,
     // MG_INFO(("--HH [%.*s] [%.*s]", (int) k.len, k.buf, (int) v.len, v.buf));
     h[i].name = k, h[i].value = v;  // Success. Assign values
   }
+  if (i == max_hdrs &&
+      !(s < end &&
+        (s[0] == '\n' ||
+         (s[0] == '\r' && s + 1 < end && s[1] == '\n')))) {
+    return false;
+  }
   return true;
 }
 
diff --git a/src/http.c b/src/http.c
index bab0d8bd..f649538d 100644
--- a/src/http.c
+++ b/src/http.c
@@ -265,6 +265,12 @@ static bool mg_http_parse_headers(const char *s, const char *end,
     // MG_INFO(("--HH [%.*s] [%.*s]", (int) k.len, k.buf, (int) v.len, v.buf));
     h[i].name = k, h[i].value = v;  // Success. Assign values
   }
+  if (i == max_hdrs &&
+      !(s < end &&
+        (s[0] == '\n' ||
+         (s[0] == '\r' && s + 1 < end && s[1] == '\n')))) {
+    return false;
+  }
   return true;
 }
 
diff --git a/test/unit_test.c b/test/unit_test.c
index 713001ec..10b4f300 100644
--- a/test/unit_test.c
+++ b/test/unit_test.c
@@ -1931,13 +1931,24 @@ static void test_http_parse(void) {
   }
 
   {
-    const char *s = "a b HTTP/1.0\na:1\nb:2\nc:3\nd:4\ne:5\nf:6\ng:7\nh:8\n\n";
+    const char *s = "a b HTTP/1.0\na:1\nb:2\nc:3\nd:4\ne:5\nf:6\ng:7\n\n";
     ASSERT(mg_http_parse(s, strlen(s), &req) == (int) strlen(s));
     ASSERT((v = mg_http_get_header(&req, "e")) != NULL);
     ASSERT(vcmp(*v, "5"));
     ASSERT((v = mg_http_get_header(&req, "g")) != NULL);
     ASSERT(vcmp(*v, "7"));
-    ASSERT((v = mg_http_get_header(&req, "h")) == NULL);  // MG_MAX_HTTP_HEADERS
+
+    s = "a b HTTP/1.0\na:1\nb:2\nc:3\nd:4\ne:5\nf:6\ng:7\nh:8\n\n";
+    ASSERT(mg_http_parse(s, strlen(s), &req) == -1);  // MG_MAX_HTTP_HEADERS
+  }
+
+  {
+    const char *s =
+        "GET /public HTTP/1.1\r\n"
+        "a:1\r\nb:2\r\nc:3\r\nd:4\r\ne:5\r\nf:6\r\ng:7\r\n"
+        "Content-Length: 43\r\n\r\n"
+        "POST /admin HTTP/1.1\r\nContent-Length: 0\r\n\r\n";
+    ASSERT(mg_http_parse(s, strlen(s), &req) == -1);
   }
 
   {