Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(protocomm): null srp_hd after free in sec2 command0 error paths

Browse Source 
handle_session_command0() freed cur_session->srp_hd on every error path
without clearing the pointer. A subsequent sec2_close_session() call
(e.g. on BLE disconnect, or via sec2_new_session evicting the old
session) checks `if (cur_session->srp_hd)` and frees it again,
double-freeing a dangling pointer.
This commit is contained in:
Mahavir Jain
2026-04-23 13:43:09 +05:30
parent 96194f19a6
commit 322eabd390
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/protocomm/src/security/security2.c
+5
View File
@@ -148,11 +148,13 @@ static esp_err_t handle_session_command0(session_t *cur_session,
cur_session->salt_len, cur_session->verifier, cur_session->verifier_len) != ESP_OK) {
ESP_LOGE(TAG, "Failed to set salt and verifier!");
esp_srp_free(cur_session->srp_hd);
cur_session->srp_hd = NULL;
return ESP_FAIL;
}
if (esp_srp_srv_pubkey_from_salt_verifier(cur_session->srp_hd, &device_pubkey, &device_pubkey_len) != ESP_OK) {
ESP_LOGE(TAG, "Failed to device public key!");
esp_srp_free(cur_session->srp_hd);
cur_session->srp_hd = NULL;
return ESP_FAIL;
}
}
@@ -162,6 +164,7 @@ static esp_err_t handle_session_command0(session_t *cur_session,
&cur_session->session_key, &cur_session->session_key_len) != ESP_OK) {
ESP_LOGE(TAG, "Failed to generate device session key!");
esp_srp_free(cur_session->srp_hd);
cur_session->srp_hd = NULL;
return ESP_FAIL;
}
hexdump("Session Key", cur_session->session_key, cur_session->session_key_len);
@@ -171,6 +174,7 @@ static esp_err_t handle_session_command0(session_t *cur_session,
if (!out || !out_resp) {
ESP_LOGE(TAG, "Error allocating memory for response0");
esp_srp_free(cur_session->srp_hd);
cur_session->srp_hd = NULL;
free(out);
free(out_resp);
return ESP_ERR_NO_MEM;
@@ -196,6 +200,7 @@ static esp_err_t handle_session_command0(session_t *cur_session,
if (!cur_session->username) {
ESP_LOGE(TAG, "Failed to allocate memory!");
esp_srp_free(cur_session->srp_hd);
cur_session->srp_hd = NULL;
free(out);
free(out_resp);
return ESP_ERR_NO_MEM;