Release v0.43.4

strtoul silently accepts a leading "-" and wraps via unsigned
arithmetic, so chunk-size "-2" produced ULONG_MAX-1, bypassing the
ULONG_MAX guard and letting a client drive the server toward unbounded
allocation.

Replace strtoul with a manual hex parser that requires at least one hex
digit, detects size_t overflow per digit, and accepts only chunk-ext or
end-of-line after the digits (RFC 9112 §7.1).

.github/workflows/test-32bit.yml

@@ -21,7 +21,8 @@ jobs:
       - name: Build (Win32)
         shell: cmd
         run: |
-          call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x86
+          for /f "usebackq tokens=*" %%i in (`"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath`) do set VSDIR=%%i
+          call "%VSDIR%\VC\Auxiliary\Build\vcvarsall.bat" x86 || exit /b 1
           cl /std:c++14 /EHsc /W4 /WX /c /Fo:NUL test\test_32bit_build.cpp
 
   test-arm32:

docs-src/config.toml

@@ -4,7 +4,7 @@ langs = ["en", "ja"]
 
 [site]
 title = "cpp-httplib"
-version = "0.43.3"
+version = "0.43.4"
 hostname = "https://yhirose.github.io"
 base_path = "/cpp-httplib"
 footer_message = "© 2026 Yuji Hirose. All rights reserved."

httplib.h

@@ -8,8 +8,8 @@
 #ifndef CPPHTTPLIB_HTTPLIB_H
 #define CPPHTTPLIB_HTTPLIB_H
 
-#define CPPHTTPLIB_VERSION "0.43.3"
-#define CPPHTTPLIB_VERSION_NUM "0x002b03"
+#define CPPHTTPLIB_VERSION "0.43.4"
+#define CPPHTTPLIB_VERSION_NUM "0x002b04"
 
 #ifdef _WIN32
 #if defined(_WIN32_WINNT) && _WIN32_WINNT < 0x0A00
@@ -12835,10 +12835,22 @@ inline ssize_t ChunkedDecoder::read_payload(char *buf, size_t len,
     stream_line_reader lr(strm, line_buf, sizeof(line_buf));
     if (!lr.getline()) { return -1; }
 
-    char *endptr = nullptr;
-    unsigned long chunk_len = std::strtoul(lr.ptr(), &endptr, 16);
-    if (endptr == lr.ptr()) { return -1; }
-    if (chunk_len == ULONG_MAX) { return -1; }
+    // RFC 9112 §7.1: chunk-size = 1*HEXDIG
+    const char *p = lr.ptr();
+    int v = 0;
+    if (!is_hex(*p, v)) { return -1; }
+
+    size_t chunk_len = 0;
+    constexpr size_t chunk_len_max = (std::numeric_limits<size_t>::max)();
+    for (; is_hex(*p, v); ++p) {
+      if (chunk_len > (chunk_len_max >> 4)) { return -1; }
+      chunk_len = (chunk_len << 4) | static_cast<size_t>(v);
+    }
+
+    while (is_space_or_tab(*p)) {
+      ++p;
+    }
+    if (*p != '\0' && *p != ';' && *p != '\r' && *p != '\n') { return -1; }
 
     if (chunk_len == 0) {
       chunk_remaining = 0;
@@ -12848,7 +12860,7 @@ inline ssize_t ChunkedDecoder::read_payload(char *buf, size_t len,
       return 0;
     }
 
-    chunk_remaining = static_cast<size_t>(chunk_len);
+    chunk_remaining = chunk_len;
     last_chunk_total = chunk_remaining;
     last_chunk_offset = 0;
   }

test/Makefile

@@ -18,8 +18,10 @@ ifneq ($(OS), Windows_NT)
 		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -lssl -lcrypto
 		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -lmbedtls -lmbedx509 -lmbedcrypto
 		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -lwolfssl
-		# Disable ASLR for ASAN compatibility on WSL2 (high-entropy ASLR conflicts with ASAN shadow memory)
-		SETARCH = setarch $(shell uname -m) -R
+		ifeq ($(UNAME_S), Linux)
+			# Disable ASLR for ASAN compatibility on WSL2 (high-entropy ASLR conflicts with ASAN shadow memory)
+			SETARCH = setarch $(shell uname -m) -R
+		endif
 	endif
 endif
 

test/test.cc

@@ -5146,6 +5146,39 @@ TEST_F(ServerTest, CaseInsensitiveTransferEncoding) {
   EXPECT_EQ(StatusCode::OK_200, res->status);
 }
 
+// GHSA-h6wq-j5mv-f3q8: the server must reject malformed chunk-size lines
+// rather than treat them as valid lengths.
+template <typename ClientT>
+static void expect_chunked_body_rejected(ClientT &cli, const char *body) {
+  Request req;
+  req.method = "POST";
+  req.path = "/chunked";
+
+  std::string host_and_port;
+  host_and_port += HOST;
+  host_and_port += ":";
+  host_and_port += std::to_string(PORT);
+
+  req.headers.emplace("Host", host_and_port.c_str());
+  req.headers.emplace("Content-Length", "0");
+  req.headers.emplace("Transfer-Encoding", "chunked");
+  req.body = body;
+
+  auto res = std::make_shared<Response>();
+  auto error = Error::Success;
+  ASSERT_TRUE(cli.send(req, *res, error));
+  EXPECT_EQ(StatusCode::BadRequest_400, res->status);
+}
+
+TEST_F(ServerTest, RejectsNegativeChunkSize) {
+  expect_chunked_body_rejected(cli_, "-2\r\nAAAA\r\n0\r\n\r\n");
+}
+
+TEST_F(ServerTest, RejectsChunkSizeWithLeadingPlus) {
+  expect_chunked_body_rejected(
+      cli_, "+4\r\ndech\r\nf\r\nunked post body\r\n0\r\n\r\n");
+}
+
 TEST_F(ServerTest, GetStreamed2) {
   auto res = cli_.Get("/streamed", {{make_range_header({{2, 3}})}});
   ASSERT_TRUE(res);

test/test_proxy.cc

@@ -291,10 +291,12 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
 
   {
     auto res = cli.Get("/get");
+    ASSERT_TRUE(res != nullptr);
     EXPECT_EQ(StatusCode::OK_200, res->status);
   }
   {
     auto res = cli.Get("/redirect/2");
+    ASSERT_TRUE(res != nullptr);
     EXPECT_EQ(StatusCode::OK_200, res->status);
   }
 
@@ -306,6 +308,7 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
 
     for (auto path : paths) {
       auto res = cli.Get(path.c_str());
+      ASSERT_TRUE(res != nullptr);
       auto body = normalizeJson(res->body);
       EXPECT_TRUE(body.find("\"authenticated\":true") != std::string::npos);
       EXPECT_TRUE(body.find("\"user\":\"hello\"") != std::string::npos);
@@ -317,6 +320,7 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
     int count = 10;
     while (count--) {
       auto res = cli.Get("/get");
+      ASSERT_TRUE(res != nullptr);
       EXPECT_EQ(StatusCode::OK_200, res->status);
     }
   }