| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-05-09 | 1.2 kB | |
| v0.43.4 source code.tar.gz | 2026-05-09 | 1.9 MB | |
| v0.43.4 source code.zip | 2026-05-09 | 2.1 MB | |
| Totals: 3 Items | 3.9 MB | 1 | |
What's Changed
Security / bug fixes
- Reject malformed chunk-size in chunked decoder:
strtoulsilently accepted a leading-and wrapped via unsigned arithmetic, so chunk-size-2producedULONG_MAX-1, bypassing theULONG_MAXguard and letting a client drive the server toward unbounded allocation. Replaced with a manual hex parser that requires at least one hex digit, detectssize_toverflow per digit, and accepts only chunk-ext or end-of-line after the digits (RFC 9112 §7.1) (87d62db) - Fix [#2441]: only invoke
setarchon Linux intest/Makefileso the test build works on FreeBSD and other non-Linux systems wheresetarchis unavailable (a9bfe59)
CI / tests
- Use
vswhereto locate the Visual Studio install in the 32-bit Windows CI workflow, so it keeps working aswindows-latestmigrates from VS 2022 to VS 2026 (#2442) - Guard
nullptr resin theKeepAliveTestproxy template so a transient upstream failure tohttpbingo.orgproduces a clean test failure instead of a SEGV under ASan (#2443)
Full Changelog: https://github.com/yhirose/cpp-httplib/compare/v0.43.3...v0.43.4