From a60f31cdd481259d7ed60ef55460af772f22fb3c Mon Sep 17 00:00:00 2001
From: Uri Tauber <uritaube@gmail.com>
Date: Thu, 4 Jun 2026 17:34:34 +0300
Subject: [PATCH] fix: Crash on invalid font filename (#2253)

Co-authored-by: Julia <julia@uxj.io>
---
 src/network/CrossPointWebServer.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/network/CrossPointWebServer.cpp b/src/network/CrossPointWebServer.cpp
index 8e251aea..dc54dd84 100644
--- a/src/network/CrossPointWebServer.cpp
+++ b/src/network/CrossPointWebServer.cpp
@@ -1763,6 +1763,9 @@ void CrossPointWebServer::handleFontUploadData() {
     case UPLOAD_FILE_START: {
       esp_task_wdt_reset();
       String family = server->arg("family");
+      fontUpload.file = HalFile();
+      fontUpload.familyName.clear();
+      fontUpload.filePath.clear();
       fontUpload.valid = false;
       fontUpload.magicChecked = false;
       fontUpload.bytesWritten = 0;
@@ -1774,6 +1777,7 @@ void CrossPointWebServer::handleFontUploadData() {
       }
 
       String filename = upload.filename;
+      filename.replace(' ', '_');
       // Validate filename: rejects path traversal (../, /, \) and enforces
       // a .cpfont basename of alphanumeric + hyphen + underscore. Without
       // this an attacker could supply "../../.crosspoint/settings.json" as
@@ -1848,7 +1852,7 @@ void CrossPointWebServer::handleFontUploadData() {
         fontUpload.bytesWritten += fontUpload.bufferPos;
         fontUpload.bufferPos = 0;
       }
-      if (fontUpload.file) {
+      if (fontUpload.file.isOpen()) {
         fontUpload.file.close();
       }