From 7528a8ffd6cebf486108e9281c774625ae1c5699 Mon Sep 17 00:00:00 2001
From: "Zachary J. Fields (OpenClaw)" <zachary_fields@outlook.com>
Date: Wed, 3 Jun 2026 19:04:54 +0000
Subject: [PATCH] test: avoid unbounded NotePing request reads

---
 test/src/NotePing_test.cpp | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/test/src/NotePing_test.cpp b/test/src/NotePing_test.cpp
index 1803e844..0487d7d1 100644
--- a/test/src/NotePing_test.cpp
+++ b/test/src/NotePing_test.cpp
@@ -102,30 +102,35 @@ const char *pingTransaction(const char *request, size_t reqLen, char **response,
     lastRequestLength = reqLen;
     lastTransactionTimeoutMs = timeoutMs;
     lastRequestEndedWithNewline = (reqLen > 0 && request[reqLen - 1] == '\n');
-    lastRequestHadCrc = (strstr(request, "\"crc\"") != NULL);
     serialBytesRemainingAtTransaction = serialBytesRemaining;
 
+    char *requestCopy = static_cast<char *>(malloc(reqLen + 1));
+    if (requestCopy == NULL) {
+        return ERRSTR("malloc failed {mem}", c_mem);
+    }
+    memcpy(requestCopy, request, reqLen);
+    requestCopy[reqLen] = '\0';
+    lastRequestHadCrc = (strstr(requestCopy, "\"crc\"") != NULL);
+
     if (pingResponse == PingResponse::TransactionError) {
+        free(requestCopy);
         return ERRSTR("transaction failed {io}", c_ioerr);
     }
     if (response == NULL || pingResponse == PingResponse::NoResponse) {
+        free(requestCopy);
         return NULL;
     }
     if (pingResponse == PingResponse::InvalidJson) {
         *response = copyString("not-json");
+        free(requestCopy);
         return NULL;
     }
     if (pingResponse == PingResponse::Error) {
         *response = copyString("{\"err\":\"failed\"}");
+        free(requestCopy);
         return NULL;
     }
 
-    char *requestCopy = static_cast<char *>(malloc(reqLen + 1));
-    if (requestCopy == NULL) {
-        return ERRSTR("malloc failed {mem}", c_mem);
-    }
-    memcpy(requestCopy, request, reqLen);
-    requestCopy[reqLen] = '\0';
     if (reqLen > 0 && requestCopy[reqLen - 1] == '\n') {
         requestCopy[reqLen - 1] = '\0';
     }