Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 10:40:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(wifi_provisioning): fixes potential null dereference on malformed packet

Browse Source
This commit is contained in:
Ashish Sharma
2026-04-10 12:29:11 +08:00
parent 200e80503f
commit 2bda8dfb4e
3 changed files with 31 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/wifi_provisioning/src/wifi_config.c
+9 -1
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -155,6 +155,14 @@ static esp_err_t cmd_set_config_handler(WiFiConfigPayload *req,
}
resp_set_config__init(resp_payload);
if (req->payload_case != WI_FI_CONFIG_PAYLOAD__PAYLOAD_CMD_SET_CONFIG || !req->cmd_set_config) {
ESP_LOGE(TAG, "Invalid set config command");
resp_payload->status = STATUS__InvalidArgument;
resp->payload_case = WI_FI_CONFIG_PAYLOAD__PAYLOAD_RESP_SET_CONFIG;
resp->resp_set_config = resp_payload;
return ESP_OK;
}
wifi_prov_config_set_data_t req_data;
memset(&req_data, 0, sizeof(req_data));
components/wifi_provisioning/src/wifi_scan.c
+22 -13
View File
@@ -1,16 +1,8 @@
// Copyright 2019 Espressif Systems (Shanghai) PTE LTD
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
/*
* SPDX-FileCopyrightText: 2019-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <stdio.h>
#include <esp_log.h>
@@ -73,6 +65,15 @@ static esp_err_t cmd_scan_start_handler(WiFiScanPayload *req,
}
resp_scan_start__init(resp_payload);
if (req->payload_case != WI_FI_SCAN_PAYLOAD__PAYLOAD_CMD_SCAN_START || !req->cmd_scan_start) {
ESP_LOGE(TAG, "Invalid scan start command");
resp->status = STATUS__InvalidArgument;
resp->payload_case = WI_FI_SCAN_PAYLOAD__PAYLOAD_RESP_SCAN_START;
resp->resp_scan_start = resp_payload;
return ESP_OK;
}
resp->status = (h->scan_start(req->cmd_scan_start->blocking,
req->cmd_scan_start->passive,
req->cmd_scan_start->group_channels,
@@ -131,6 +132,14 @@ static esp_err_t cmd_scan_result_handler(WiFiScanPayload *req,
}
resp_scan_result__init(resp_payload);
if (req->payload_case != WI_FI_SCAN_PAYLOAD__PAYLOAD_CMD_SCAN_RESULT || !req->cmd_scan_result) {
ESP_LOGE(TAG, "Invalid scan result command");
resp->status = STATUS__InvalidArgument;
resp->payload_case = WI_FI_SCAN_PAYLOAD__PAYLOAD_RESP_SCAN_RESULT;
resp->resp_scan_result = resp_payload;
return ESP_OK;
}
resp->status = STATUS__Success;
resp->payload_case = WI_FI_SCAN_PAYLOAD__PAYLOAD_RESP_SCAN_RESULT;
resp->resp_scan_result = resp_payload;
tools/ci/check_copyright_ignore.txt
-1
View File
@@ -563,7 +563,6 @@ components/wifi_provisioning/python/wifi_config_pb2.py
components/wifi_provisioning/python/wifi_constants_pb2.py
components/wifi_provisioning/python/wifi_scan_pb2.py
components/wifi_provisioning/src/scheme_console.c
components/wifi_provisioning/src/wifi_scan.c
components/wpa_supplicant/esp_supplicant/src/esp_wpa_err.h
components/wpa_supplicant/include/utils/wpa_debug.h
components/wpa_supplicant/include/utils/wpabuf.h