From 641c2f7c5341c2391060865b19999fecefc6a3a7 Mon Sep 17 00:00:00 2001
From: yi chen <94xhn1@gmail.com>
Date: Fri, 10 Jul 2026 06:53:33 +0800
Subject: [PATCH] fix(protocomm): free response buffers on 2nd
 psa_cipher_update failure

In handle_session_command1(), if the second psa_cipher_update()
call (encrypting the device verify data to send back to the client)
fails, the error path only frees the outbuf ciphertext buffer. The
out (Sec1Payload) and out_resp (SessionResp1) structures allocated
just before it are never freed, and neither the cipher operation
(cur_session->ctx_aes) nor the imported key (key_id) are released.

The caller (sec1_req_handler(), via sec1_session_setup()) returns
immediately on a non-ESP_OK result without doing any cleanup of its
own here - sec1_session_setup_cleanup() only runs on the success
path, once resp->sec1 has actually been assigned - so nothing else
ever frees these on this path.

Add psa_cipher_abort()/psa_destroy_key() and free() for out/out_resp,
matching the cleanup already done for every other failure branch
earlier in this same function.

Fixes #18804

Signed-off-by: yi chen <94xhn1@gmail.com>
---
 components/protocomm/src/security/security1.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/components/protocomm/src/security/security1.c b/components/protocomm/src/security/security1.c
index 2a971752a4e..0f9d4056ecb 100644
--- a/components/protocomm/src/security/security1.c
+++ b/components/protocomm/src/security/security1.c
@@ -196,7 +196,11 @@ static esp_err_t handle_session_command1(session_t *cur_session,
     status = psa_cipher_update(&cur_session->ctx_aes, cur_session->client_pubkey, sizeof(cur_session->client_pubkey), outbuf, PUBLIC_KEY_LEN, &outlen);
     if (status != PSA_SUCCESS) {
         ESP_LOGE(TAG, "Failed at psa_cipher_update with error code : %d", status);
+        psa_cipher_abort(&cur_session->ctx_aes);
+        psa_destroy_key(key_id);
         free(outbuf);
+        free(out_resp);
+        free(out);
         return ESP_FAIL;
     }