From 2fec4e6930f9f1603a39f58d61fc089c3e8be226 Mon Sep 17 00:00:00 2001 From: Konstantin Kondrashov Date: Mon, 6 Jul 2026 15:05:53 +0300 Subject: [PATCH] fix(esp_event): fix format string vulnerability in esp_event_dump (SEC-064) fprintf(file, buf) is a format-string sink: if any registered event base or handler name contains "%", fprintf interprets it as a format directive, causing an information leak or crash. Replace with fprintf(file, "%s", buf) so the buffer is always treated as plain text regardless of its content. Closes SEC_064 --- components/esp_event/esp_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/esp_event/esp_event.c b/components/esp_event/esp_event.c index 9358d910e23..88e0561bcfa 100644 --- a/components/esp_event/esp_event.c +++ b/components/esp_event/esp_event.c @@ -1097,7 +1097,7 @@ esp_err_t esp_event_dump(FILE* file) portEXIT_CRITICAL(&s_event_loops_spinlock); // Print the contents of the buffer to the file - fprintf(file, buf); + fprintf(file, "%s", buf); // Free the allocated buffer free(buf);