From e7459df725559e8e4f02a4f446190d825317b2b2 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Wed, 17 Jun 2026 20:38:46 +0200
Subject: [PATCH] Another URL API fix

---
 src/url_unreal.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/url_unreal.c b/src/url_unreal.c
index 799f6e5f1..ddb45a538 100644
--- a/src/url_unreal.c
+++ b/src/url_unreal.c
@@ -824,9 +824,14 @@ int https_handle_response_header(Download *handle, char *readbuf, int n)
 		}
 	}
 
-	if (lastloc)
+	if (!end_of_request && lastloc)
 	{
-		/* Last line was cut somewhere, save it for next round. */
+		/* Save a cut-off (incomplete) header line for the next packet.
+		 * Only while still reading headers: once end_of_request is set,
+		 * lastloc points at body data that https_handle_response_body()
+		 * already owns via handle->lefttoparse/lefttoparselen, so touching
+		 * it here would desync those two and cause an out-of-bounds read.
+		 */
 		safe_strdup(handle->lefttoparse, lastloc);
 	}