1 files changed, 99 insertions, 78 deletions

diff --git a/ot_http.c b/ot_http.c
index 4675efb..36819c7 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -14,9 +14,6 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-/* Libowfat */
-#include "io.h"
-
 /* Opentracker */
 #include "ot_accesslist.h"
 #include "ot_fullscrape.h"
@@ -25,8 +22,11 @@
 #include "ot_ip.h"
 #include "ot_mutex.h"
 #include "ot_scan.h"
+#include "ot_event.h"
+#include "ot_fdstate.h"
+#include "ot_fmt.h"
 #include "ot_stats.h"
-#include "scan_urlencoded_query.h"
+#include "ot_urlencoded.h"
 #include "trackerlogic.h"
 
 #define OT_MAXMULTISCRAPE_COUNT 64
@@ -38,11 +38,11 @@ ssize_t      g_stats_path_len;
 enum { SUCCESS_HTTP_HEADER_LENGTH = 80, SUCCESS_HTTP_SIZE_OFF = 17 };
 
 static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
   ssize_t           written_size;
 
   if (!cookie) {
-    io_close(sock);
+    event_del((int)sock), close((int)sock);
     return;
   }
 
@@ -66,18 +66,17 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
   if ((written_size < 0) || ((written_size == ws->reply_size) && !ws->keep_alive)) {
     buf_reset(&cookie->request);
     free(cookie);
-    io_close(sock);
+    event_del((int)sock), close((int)sock);
     return;
   }
 
   if (written_size < ws->reply_size) {
     char   *outbuf;
-    tai6464 t;
 
     if (!(outbuf = malloc(ws->reply_size - written_size))) {
       buf_reset(&cookie->request);
       free(cookie);
-      io_close(sock);
+      event_del((int)sock), close((int)sock);
       return;
     }
 
@@ -88,7 +87,7 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
         free(outbuf);
         buf_reset(&cookie->request);
         free(cookie);
-        io_close(sock);
+        event_del((int)sock), close((int)sock);
         return;
       }
     }
@@ -97,11 +96,10 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
 
     /* writeable short data sockets just have a tcp timeout */
     if (!ws->keep_alive) {
-      taia_uint(&t, 0);
-      io_timeout(sock, t);
-      io_dontwantread(sock);
+      fdstate_set_expiry(sock, 0);
+      http_interest_drop(sock, cookie, EVENT_IN);
     }
-    io_wantwrite(sock);
+    http_interest_add(sock, cookie, EVENT_OUT);
   }
 }
 
@@ -114,6 +112,21 @@ static void http_senddata(const int64_t sock, struct ot_workstruct *ws) {
 #define HTTPERROR_403_IP         return http_issue_error(sock, ws, CODE_HTTPERROR_403_IP)
 #define HTTPERROR_404            return http_issue_error(sock, ws, CODE_HTTPERROR_404)
 #define HTTPERROR_500            return http_issue_error(sock, ws, CODE_HTTPERROR_500)
+static void http_interest(const int64_t sock, struct http_data *cookie, int what) {
+  if (cookie->interest == what)
+    return;
+  cookie->interest = what;
+  event_modify((int)sock, what, fdstate_generation((int)sock));
+}
+
+void http_interest_add(const int64_t sock, struct http_data *cookie, int what) {
+  http_interest(sock, cookie, cookie->interest | what);
+}
+
+void http_interest_drop(const int64_t sock, struct http_data *cookie, int what) {
+  http_interest(sock, cookie, cookie->interest & ~what);
+}
+
 ssize_t http_issue_error(const int64_t sock, struct ot_workstruct *ws, int code) {
   const char *error_code[] = {"302 Found",      "400 Invalid Request", "400 Invalid Request", "400 Invalid Request",      "402 Payment Required",
                         "403 Not Modest", "403 Access Denied",   "404 Not Found",       "500 Internal Server Error"};
@@ -135,11 +148,10 @@ ssize_t http_issue_error(const int64_t sock, struct ot_workstruct *ws, int code)
 }
 
 ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t iovec_entries, struct iovec *iovector, int is_partial) {
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
   char             *header;
   const char       *encoding = "";
   size_t            header_size, size = iovec_length(&iovec_entries, (const struct iovec **)&iovector);
-  tai6464           t;
 
   /* No cookie? Bad socket. Leave. */
   if (!cookie) {
@@ -159,7 +171,7 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t
 
   /* If we came here, wait for the answer is over */
   if (cookie->flag & STRUCT_HTTP_FLAG_WAITINGFORTASK) {
-    io_dontwantread(sock);
+    http_interest_drop(sock, cookie, EVENT_IN);
     cookie->flag &= ~STRUCT_HTTP_FLAG_WAITINGFORTASK;
   }
 
@@ -209,11 +221,8 @@ ssize_t http_sendiovecdata(const int64_t sock, struct ot_workstruct *ws, size_t
     cookie->flag &= ~STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER;
   }
 
-  /* writeable sockets timeout after 10 minutes */
-  taia_now(&t);
-  taia_addsec(&t, &t, OT_CLIENT_TIMEOUT_SEND);
-  io_timeout(sock, t);
-  io_wantwrite(sock);
+  fdstate_set_expiry(sock, g_now_seconds + OT_CLIENT_TIMEOUT_SEND);
+  http_interest_add(sock, cookie, EVENT_OUT);
   return 0;
 }
 
@@ -248,7 +257,8 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
                                                 {"url", TASK_FULLSCRAPE_TPB_URLENCODED},  {"txt", TASK_FULLSCRAPE_TPB_ASCII},
                                                 {"txtp", TASK_FULLSCRAPE_TPB_ASCII_PLUS}, {NULL, -3}};
 
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
+  char             *reply;
   int               mode = TASK_STATS_PEERS, scanon = 1, format = 0;
 
   /* A socket without one is a dead socket, which is what http_sendiovecdata
@@ -262,21 +272,21 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
 #endif
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_main, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_main, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     case -1:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "mode" */
-      if ((mode = scan_find_keywords(keywords_mode, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((mode = urlencoded_match_keyword(keywords_mode, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
       break;
     case 2: /* matched "format" */
-      if ((format = scan_find_keywords(keywords_format, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((format = urlencoded_match_keyword(keywords_format, &read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
       break;
     case 3:
@@ -291,7 +301,6 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
   }
 
   if (mode == TASK_STATS_TPB) {
-    tai6464 t;
 #ifdef WANT_COMPRESSION_GZIP
     ws->request[ws->request_size - 1] = 0;
 #ifndef WANT_COMPRESSION_GZIP_ALWAYS
@@ -307,29 +316,28 @@ static ssize_t http_handle_stats(const int64_t sock, struct ot_workstruct *ws, c
     cookie->flag |= STRUCT_HTTP_FLAG_WAITINGFORTASK | STRUCT_HTTP_FLAG_CHUNKED;
 
     /* Clients waiting for us should not easily timeout */
-    taia_uint(&t, 0);
-    io_timeout(sock, t);
+    fdstate_set_expiry(sock, 0);
     fullscrape_deliver(sock, format);
-    io_dontwantread(sock);
+    http_interest_drop(sock, cookie, EVENT_IN);
     return ws->reply_size = -2;
   }
 #endif
 
   /* default format for now */
   if ((mode & TASK_CLASS_MASK) == TASK_STATS) {
-    tai6464 t;
 
     cookie->flag |= STRUCT_HTTP_FLAG_WAITINGFORTASK;
 
     /* Complex stats also include expensive memory debugging tools */
-    taia_uint(&t, 0);
-    io_timeout(sock, t);
+    fdstate_set_expiry(sock, 0);
     stats_deliver(sock, mode);
     return ws->reply_size = -2;
   }
 
   /* Simple stats can be answerred immediately */
-  return ws->reply_size = return_stats_for_tracker(ws->reply, mode, 0);
+  reply = ws->reply;
+  return_stats_for_tracker(&reply, ws->outbuf + G_OUTBUF_SIZE, mode, 0);
+  return ws->reply_size = reply - ws->reply;
 }
 
 #ifdef WANT_MODEST_FULLSCRAPES
@@ -343,9 +351,8 @@ typedef struct {
 
 #ifdef WANT_FULLSCRAPE
 static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *ws) {
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
   int               format = 0;
-  tai6464           t;
 
 #ifdef WANT_MODEST_FULLSCRAPES
   {
@@ -404,10 +411,9 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *
   /* Pass this task to the worker thread */
   cookie->flag |= STRUCT_HTTP_FLAG_WAITINGFORTASK | STRUCT_HTTP_FLAG_CHUNKED;
   /* Clients waiting for us should not easily timeout */
-  taia_uint(&t, 0);
-  io_timeout(sock, t);
+  fdstate_set_expiry(sock, 0);
   fullscrape_deliver(sock, format);
-  io_dontwantread(sock);
+  http_interest_drop(sock, cookie, EVENT_IN);
   return ws->reply_size = -2;
 }
 #endif
@@ -415,9 +421,10 @@ static ssize_t http_handle_fullscrape(const int64_t sock, struct ot_workstruct *
 static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   static const ot_keywords keywords_scrape[] = {{"info_hash", 1}, {NULL, -3}};
 
-  ot_hash *multiscrape_buf   = (ot_hash *)ws->request;
-  int      scanon = 1;
-  size_t   numwant = 0;
+  ot_hash *multiscrape_buf = (ot_hash *)ws->request;
+  char    *reply           = ws->reply;
+  int      scanon          = 1;
+  size_t   numwant         = 0;
 
   /* This is to hack around stupid clients that send "scrape ?info_hash" */
   if (read_ptr[-1] != '?') {
@@ -429,18 +436,18 @@ static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws,
   }
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_scrape, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_scrape, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     default:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "info_hash" */
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, (char *)(multiscrape_buf + numwant++), SCAN_SEARCHPATH_VALUE) != (ssize_t)sizeof(ot_hash))
+      if (urlencoded_parse(&read_ptr, (char *)(multiscrape_buf + numwant++), SCAN_SEARCHPATH_VALUE) != (ssize_t)sizeof(ot_hash))
         HTTPERROR_400_PARAM;
       break;
     }
@@ -455,7 +462,8 @@ static ssize_t http_handle_scrape(const int64_t sock, struct ot_workstruct *ws,
     numwant = OT_MAXMULTISCRAPE_COUNT;
 
   /* Enough for http header + whole scrape string */
-  ws->reply_size = return_tcp_scrape_for_torrent((const ot_hash *)multiscrape_buf, numwant, ws->reply);
+  return_tcp_scrape_for_torrent((const ot_hash *)multiscrape_buf, numwant, &reply, ws->outbuf + G_OUTBUF_SIZE);
+  ws->reply_size = reply - ws->reply;
   stats_issue_event(EVENT_SCRAPE, FLAG_TCP, ws->reply_size);
   return ws->reply_size;
 }
@@ -491,13 +499,24 @@ static ot_keywords keywords_announce[] = {{"port", 1},    {"left", 2}, {"event",
 #endif
                                           {"peer_id", 9}, {NULL, -3}};
 static ot_keywords keywords_announce_event[] = {{"completed", 1}, {"stopped", 2}, {NULL, -3}};
+
+/* For the replies that are one fixed string and nothing else, where the only
+   thing the caller wants back is how long it turned out */
+static ssize_t     reply_literal(struct ot_workstruct *ws, const char *text) {
+  char *reply = ws->reply;
+
+  fmt_bytes(&reply, ws->outbuf + G_OUTBUF_SIZE, text, strlen(text));
+  return reply - ws->reply;
+}
+
 static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct *ws, char *read_ptr) {
   size_t            numwant;
-  int               tmp, scanon;
+  int64_t           tmp;
+  int               scanon;
   unsigned short    port = 0;
   char             *write_ptr;
   ssize_t           len;
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
 
   /* This is to hack around stupid clients that send "announce ?info_hash" */
   if (read_ptr[-1] != '?') {
@@ -512,7 +531,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
   if (accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_PROXY)) {
     ot_ip6 proxied_ip;
     char  *fwd = http_header(ws->request, ws->header_size, "x-forwarded-for");
-    if (fwd && ip_scan(fwd, proxied_ip)) {
+    if (fwd && ip_parse(fwd, proxied_ip)) {
       OT_SETIP(ws->peer, proxied_ip);
     } else
       OT_SETIP(ws->peer, cookie->ip);
@@ -529,32 +548,32 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
   scanon                = 1;
 
   while (scanon) {
-    switch (scan_find_keywords(keywords_announce, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
+    switch (urlencoded_match_keyword(keywords_announce, &read_ptr, SCAN_SEARCHPATH_PARAM)) {
     case -2:
       scanon = 0;
       break; /* TERMINATOR */
     case -1:
       HTTPERROR_400_PARAM; /* PARSE ERROR */
     case -3:
-      scan_urlencoded_skipvalue(&read_ptr);
+      urlencoded_skip_value(&read_ptr);
       break;
     case 1: /* matched "port" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp) || (tmp > 0xffff))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp) || (tmp > 0xffff))
         HTTPERROR_400_PARAM;
-      port = htons(tmp);
+      port = htons((uint16_t)tmp);
       OT_SETPORT(&ws->peer, &port);
       break;
     case 2: /* matched "left" */
-      if ((len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
+      if ((len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE)) <= 0)
         HTTPERROR_400_PARAM;
-      if (scan_fixed_int(write_ptr, len, &tmp))
+      if (scan_int(write_ptr, len, &tmp))
         tmp = 0;
       if (!tmp)
         OT_PEERFLAG(&ws->peer) |= PEER_FLAG_SEEDING;
       break;
     case 3: /* matched "event" */
-      switch (scan_find_keywords(keywords_announce_event, &read_ptr, SCAN_SEARCHPATH_VALUE)) {
+      switch (urlencoded_match_keyword(keywords_announce_event, &read_ptr, SCAN_SEARCHPATH_VALUE)) {
       case -1:
         HTTPERROR_400_PARAM;
       case 1: /* matched "completed" */
@@ -568,18 +587,18 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       }
       break;
     case 4: /* matched "numwant" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp))
         HTTPERROR_400_PARAM;
       if (tmp < 0)
         tmp = 50;
       if (tmp > 200)
         tmp = 200;
-      numwant = tmp;
+      numwant = (size_t)tmp;
       break;
     case 5: /* matched "compact" */
-      len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
-      if ((len <= 0) || scan_fixed_int(write_ptr, len, &tmp))
+      len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE);
+      if ((len <= 0) || scan_int(write_ptr, len, &tmp))
         HTTPERROR_400_PARAM;
       if (!tmp)
         HTTPERROR_400_COMPACT;
@@ -588,7 +607,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       if (ws->hash)
         HTTPERROR_400_DOUBLEHASH;
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
+      if (urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
         HTTPERROR_400_PARAM;
       ws->hash = (ot_hash *)write_ptr;
       break;
@@ -596,9 +615,9 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
     case 7: /* matched "ip" */
     {
       char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16;
-      len           = scan_urlencoded_query(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE);
+      len           = urlencoded_parse(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE);
       tmp_buf2[len] = 0;
-      if ((len <= 0) || !ip_scan(tmp_buf2, tmp_buf1))
+      if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len)
         HTTPERROR_400_PARAM;
       OT_SETIP(&ws->peer, tmp_buf1);
     } break;
@@ -612,21 +631,21 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       uint64_t     value;
       signed short parsed, bits;
 
-      len          = scan_urlencoded_query(&read_ptr, tmp_buf, SCAN_SEARCHPATH_VALUE);
+      len          = urlencoded_parse(&read_ptr, tmp_buf, SCAN_SEARCHPATH_VALUE);
       tmp_buf[len] = 0;
       if (len <= 0)
         HTTPERROR_400_PARAM;
       if (*tmp_buf == '-') {
         loglist_reset();
-        return ws->reply_size = sprintf(ws->reply, "Successfully removed.\n");
+        return ws->reply_size = reply_literal(ws, "Successfully removed.\n");
       }
-      parsed = ip_scan(tmp_buf, net.address);
+      parsed = ip_parse(tmp_buf, net.address);
       if (!parsed)
         HTTPERROR_400_PARAM;
       if (tmp_buf[parsed++] != '/')
         bits = 128;
       else {
-        parsed = scan_udec(tmp_buf + parsed, &value, 128);
+        parsed = scan_uint(tmp_buf + parsed, &value, 128);
         if (!parsed)
           HTTPERROR_400_PARAM;
         bits = (signed short)value;
@@ -635,13 +654,13 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       }
       net.bits = bits;
       loglist_add_network(&net);
-      return ws->reply_size = sprintf(ws->reply, "Successfully added.\n");
+      return ws->reply_size = reply_literal(ws, "Successfully added.\n");
       //}
     } break;
 #endif
     case 9: /* matched "peer_id" */
       /* ignore this, when we have less than 20 bytes */
-      if (scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
+      if (urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_SEARCHPATH_VALUE) != 20)
         HTTPERROR_400_PARAM;
       ws->peer_id = write_ptr;
       break;
@@ -658,7 +677,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
 
   /* Scanned whole query string */
   if (!ws->hash)
-    return ws->reply_size = sprintf(ws->reply, "d14:failure reason80:Your client forgot to send your torrent's info_hash. Please upgrade your client.e");
+    return ws->reply_size = reply_literal(ws, "d14:failure reason80:Your client forgot to send your torrent's info_hash. Please upgrade your client.e");
 
   if (OT_PEERFLAG(&ws->peer) & PEER_FLAG_STOPPED)
     ws->reply_size = remove_peer_from_torrent(FLAG_TCP, ws);
@@ -674,7 +693,7 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   char   *read_ptr = ws->request, *write_ptr;
 
 #ifdef WANT_FULLLOG_NETWORKS
-  struct http_data *cookie = io_getcookie(sock);
+  struct http_data *cookie = fdstate_cookie(sock);
   if (loglist_check_address(cookie->ip)) {
     ot_log *log = malloc(sizeof(ot_log));
     if (log) {
@@ -720,7 +739,7 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
      In reality we abandoned requiring the url to be correct. This now
      only decodes url encoded characters, we check for announces and
      scrapes by looking for "a*" or "sc" */
-  len = scan_urlencoded_query(&read_ptr, write_ptr = read_ptr, SCAN_PATH);
+  len = urlencoded_parse(&read_ptr, write_ptr = read_ptr, SCAN_PATH);
 
   /* If parsing returned an error, leave with not found */
   if (g_redirecturl && (len == -2))
@@ -769,9 +788,11 @@ ssize_t http_handle_request(const int64_t sock, struct ot_workstruct *ws) {
   reply_off       = SUCCESS_HTTP_SIZE_OFF - snprintf(ws->outbuf, 0, "%zd", ws->reply_size);
   ws->reply       = ws->outbuf + reply_off;
 
-  /* 2. Now we sprintf our header so that sprintf writes its terminating '\0' exactly one byte before content starts. Complete
-     packet size is increased by size of header plus one byte '\n', we will copy over '\0' in next step */
-  ws->reply_size += 1 + sprintf(ws->reply, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %zd\r\n\r", ws->reply_size);
+  /* 2. Now we write the header so that its terminating '\0' lands exactly one byte before the content starts. The bound is the
+     space step 1 reserved, so the '\0' falls where step 3 expects it. Complete packet size is increased by size of header plus
+     one byte '\n', we will copy over '\0' in next step */
+  ws->reply_size += 1 + snprintf(ws->reply, (size_t)(SUCCESS_HTTP_HEADER_LENGTH - reply_off),
+                                 "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: %zd\r\n\r", ws->reply_size);
 
   /* 3. Finally we join both blocks neatly */
   ws->outbuf[SUCCESS_HTTP_HEADER_LENGTH - 1] = '\n';