From 382e16cc7fb487166941a553b6c1efc07dfb9bd0 Mon Sep 17 00:00:00 2001
From: Jon Shallow <supjps-libcoap@jpshallow.com>
Date: Thu, 7 May 2026 16:32:53 +0100
Subject: [PATCH] coap_ws.c: Fix potential OOB on read headers

---
 src/coap_ws.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/coap_ws.c b/src/coap_ws.c
index 3b90a152..d1d31616 100644
--- a/src/coap_ws.c
+++ b/src/coap_ws.c
@@ -498,7 +498,7 @@ coap_ws_rd_http_header(coap_session_t *session) {
      * some frame info that needs to be subsequently processed
      */
     rem = ws->http_ofs > (sizeof(ws->http_hdr) - 1 - COAP_MAX_FS) ?
-          sizeof(ws->http_hdr) - ws->http_ofs : COAP_MAX_FS;
+          sizeof(ws->http_hdr) - ws->http_ofs -1 : COAP_MAX_FS;
     bytes = session->sock.lfunc[COAP_LAYER_WS].l_read(session,
                                                       &ws->http_hdr[ws->http_ofs],
                                                       rem);