Fix heap overflow in captive-portal 302 redirect

[maxim75]

Summary

• process_redirect() in components/wifi-manager/http_server_handlers.c allocated redirect_url one byte too small (no room for the trailing /) and passed the size of a different, larger buffer (buf_size) as the snprintf length limit instead of the actual allocation size (url_buf_size). This wrote past the end of the redirect_url heap block, corrupting the next block's tail guard.
• Reproduced on real ESP32-S3 hardware: connecting a phone/laptop to the device's AP triggers a captive-portal probe (e.g. /hotspot-detect.html), which hits the 302-redirect path and crashes with CORRUPT HEAP: Bad tail / assert failed: multi_heap_free.
• Fix: size url_buf_size to include the / and NUL, and pass that (not buf_size) to snprintf.

Test plan

• Built firmware for esp32s3 (ESP-IDF v4.4.5, Docker) and flashed to a physical ESP32-S3-DevKitC-1 (N16R8) board
• Confirmed clean boot to the recovery console before the fix, then reproduced the heap-corruption crash by connecting a client and letting it issue a captive-portal probe request
• Applied the fix, rebuilt, reflashed, reproduced the same captive-portal request — no crash, clean 302 redirect

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a detailed guide (INSTALL_HOW_TO.md) for building and flashing Squeezelite-ESP32 on ESP32-S3 boards and fixes a buffer size calculation and snprintf limit when handling HTTP 302 redirects in http_server_handlers.c. The review feedback highlights a missing NULL check on a memory allocation in http_server_handlers.c that could lead to a crash, and suggests adding an explicit flush to the Python boot verification script in the documentation to prevent buffered output from appearing hung.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The allocation of redirect_url using malloc_init_external on the subsequent line (line 954) is not checked for NULL. If the allocation fails due to memory exhaustion, the subsequent memset and snprintf calls will dereference a null pointer and crash the device. Consider adding a NULL check for redirect_url before using it.

[gemini-code-assist]

In Python 3, sys.stdout (and its underlying buffer) is buffered by default when writing bytes. Without an explicit flush, the serial output may not be displayed in real-time, making the monitor script appear to hang. Adding sys.stdout.buffer.flush() ensures immediate display of the received data.

Suggested change

	sys.stdout.buffer.write(data)
	sys.stdout.buffer.write(data)
	sys.stdout.buffer.flush()