Author: Andy Green <andy@warmcat.com>
Date: Sun Apr 19 20:55:37 2026 +0100

CID 503244: OUT-OF-BOUNDS


diff --git a/src/server/s-power.c b/src/server/s-power.c
index dac5982..a8f3e35 100644
--- a/src/server/s-power.c
+++ b/src/server/s-power.c
@@ -321,7 +321,7 @@ cb_lookup_pcon(void *user, int cols, char **values, char **name)
 int
 sais_power_tx(struct vhd *vhd, struct pss *pss, uint8_t *buf, size_t bl)
 {
-	uint8_t *start = buf + LWS_PRE, *p = start, *end = p + bl - LWS_PRE - 1;
+	uint8_t *start = buf + LWS_PRE, *p = start, *end = buf + bl - 1;
 	enum lws_write_protocol flags;
 	size_t w;
 	int n, diff = 0;
diff --git a/src/server/s-ws-builder.c b/src/server/s-ws-builder.c
index 070fddb..c7227cb 100644
--- a/src/server/s-ws-builder.c
+++ b/src/server/s-ws-builder.c
@@ -1362,7 +1362,7 @@ int
 sais_ws_json_tx_builder(struct vhd *vhd, struct pss *pss, uint8_t *buf,
 			size_t bl)
 {
-	uint8_t *start = buf + LWS_PRE, *p = start, *end = p + bl - LWS_PRE - 1;
+	uint8_t *start = buf + LWS_PRE, *p = start, *end = buf + bl - 1;
 	int n, flags = LWS_WRITE_TEXT, first = 1;
 	lws_struct_serialize_t *js;
 	sai_task_t *task;