From 7ebe341c06e65f5365c54dfadc138d57c5cc2b1f Mon Sep 17 00:00:00 2001
From: Alex Petrochenko <petrochen@gmail.com>
Date: Mon, 18 May 2026 15:57:41 +0100
Subject: [PATCH] fix(web): clamp lastError before snprintf to prevent
 malformed JSON (Gemini review)

---
 firmware/weather_clock/web_server.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/firmware/weather_clock/web_server.cpp b/firmware/weather_clock/web_server.cpp
index fb7c020..add3c15 100644
--- a/firmware/weather_clock/web_server.cpp
+++ b/firmware/weather_clock/web_server.cpp
@@ -387,16 +387,21 @@ void ICACHE_FLASH_ATTR handleAPIStatus() {
 
 void ICACHE_FLASH_ATTR handleAPIDebug() {
   char buf[256];
+  char errBuf[80];
 
   server.setContentLength(CONTENT_LENGTH_UNKNOWN);
   server.send(200, "application/json", "");
 
+  // Clamp lastError to prevent snprintf truncation causing malformed JSON
+  strncpy(errBuf, lastError.c_str(), sizeof(errBuf) - 1);
+  errBuf[sizeof(errBuf) - 1] = '\0';
+
   snprintf_P(buf, sizeof(buf),
     PSTR("{\"internet_connected\":%s,\"ntp_attempts\":%d,\"ntp_successes\":%d,\"last_error\":\"%s\",\"gateway\":\"%s\",\"dns\":\"%s\"}"),
     internetConnected ? "true" : "false",
     ntpAttempts,
     ntpSuccesses,
-    lastError.c_str(),
+    errBuf,
     WiFi.gatewayIP().toString().c_str(),
     WiFi.dnsIP().toString().c_str());
   server.sendContent(buf);