From f7399e00697ce453dcef5ea05fcc3032565c37fb Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Tue, 14 Apr 2026 11:05:51 +0530 Subject: [PATCH] fix(protocomm): pass current session id when closing existing session sec1_new_session()/sec2_new_session() were calling sec*_close_session() with the *new* session_id parameter instead of the existing cur_session->id. The close handler validates `cur_session->id == session_id` before performing teardown, so the call always failed with ESP_ERR_INVALID_STATE. Effect: when a peer started a new provisioning session while another was already active, the previous session's PSA keys, AES context, SRP handle and username buffer were leaked instead of being destroyed. The cleared session struct was overwritten by the new session, leaking the previous key handles inside PSA Crypto and (for security2) leaking heap memory for the username and SRP context. Fix: pass cur_session->id so the close path actually executes the teardown (psa_destroy_key/psa_cipher_abort/esp_srp_free/free) before the new session takes over. --- components/protocomm/src/security/security1.c | 2 +- components/protocomm/src/security/security2.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/protocomm/src/security/security1.c b/components/protocomm/src/security/security1.c index 9afdcce6267..f4df68ec56e 100644 --- a/components/protocomm/src/security/security1.c +++ b/components/protocomm/src/security/security1.c @@ -491,7 +491,7 @@ static esp_err_t sec1_new_session(protocomm_security_handle_t handle, uint32_t s if (cur_session->id != -1) { /* Only one session is allowed at a time */ ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id); - sec1_close_session(cur_session, session_id); + sec1_close_session(cur_session, cur_session->id); } cur_session->id = session_id; diff --git a/components/protocomm/src/security/security2.c b/components/protocomm/src/security/security2.c index 705a8ba7c1f..e6d132f24ac 100644 --- a/components/protocomm/src/security/security2.c +++ b/components/protocomm/src/security/security2.c @@ -427,7 +427,7 @@ static esp_err_t sec2_new_session(protocomm_security_handle_t handle, uint32_t s if (cur_session->id != -1) { /* Only one session is allowed at a time */ ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id); - sec2_close_session(cur_session, session_id); + sec2_close_session(cur_session, cur_session->id); } cur_session->id = session_id;