From 9e1a8e8316878e78bd0e5d9760e8b69a2955b60a Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Sun, 1 Mar 2026 18:16:21 -0600 Subject: [PATCH] fix: use dynamic allocation for admin/hosts endpoint and add auth check the 64KB stack buffer overflows with 2800+ hosts, causing 502 responses. switch to ArrayList writer for unbounded JSON response. also adds the missing checkAdmin gate that other admin endpoints already have. Co-Authored-By: Claude Opus 4.6 --- src/main.zig | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/main.zig b/src/main.zig index b396d1d..e59baff 100644 --- a/src/main.zig +++ b/src/main.zig @@ -387,6 +387,8 @@ fn handleRequestCrawl(request: *http.Server.Request, slurper: *slurper_mod.Slurp // --- admin host management --- fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.DiskPersist, slurper: *slurper_mod.Slurper) void { + if (!checkAdmin(request)) return; + const hosts = persist.listAllHosts(persist.allocator) catch { respondJson(request, .internal_server_error, "{\"error\":\"DatabaseError\",\"message\":\"query failed\"}"); return; @@ -399,9 +401,9 @@ fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.D persist.allocator.free(hosts); } - var buf: [65536]u8 = undefined; - var fbs = std.io.fixedBufferStream(&buf); - const w = fbs.writer(); + var list: std.ArrayListUnmanaged(u8) = .{}; + defer list.deinit(persist.allocator); + const w = list.writer(persist.allocator); w.writeAll("{\"hosts\":[") catch return; @@ -417,7 +419,7 @@ fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.D } std.fmt.format(w, "],\"active_workers\":{d}}}", .{slurper.workerCount()}) catch return; - respondJson(request, .ok, fbs.getWritten()); + respondJson(request, .ok, list.items); } fn handleAdminBlockHost(request: *http.Server.Request, persist: *event_log_mod.DiskPersist) void { -- 2.51.2