From 9e1e33a151aae439188e852e820bce8f81b56ebd Mon Sep 17 00:00:00 2001 From: zhangyanjiao Date: Tue, 21 Jul 2026 14:09:35 +0800 Subject: [PATCH 1/3] fix(wifi): fixed the buffer overflow issues 1. Added validation for password and reserved data length in ESPTouch v2 2. Added bound check for data index in ESPTouch v1 HT40 3. prevent buffer overflow when parsing MBSSID beacon --- components/esp_wifi/lib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib index c703130767a..4e2d48c7ee9 160000 --- a/components/esp_wifi/lib +++ b/components/esp_wifi/lib @@ -1 +1 @@ -Subproject commit c703130767ae3af192ad9ab96c2d558bd01f4e6b +Subproject commit 4e2d48c7ee984ee5329e49be485c4d280c3554fd From 0290f8fc2d0910c5e1a288f9942a3b44cdbb481b Mon Sep 17 00:00:00 2001 From: zhangyanjiao Date: Thu, 23 Jul 2026 10:45:24 +0800 Subject: [PATCH 2/3] fix(wifi): fixed the assignment error in esptouch v2 --- components/esp_wifi/lib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib index 4e2d48c7ee9..51d25c5309b 160000 --- a/components/esp_wifi/lib +++ b/components/esp_wifi/lib @@ -1 +1 @@ -Subproject commit 4e2d48c7ee984ee5329e49be485c4d280c3554fd +Subproject commit 51d25c5309b92a3cb285657c291df00c7e758cee From 85a59c8405aef4e2257858d84ab0c63595963a2f Mon Sep 17 00:00:00 2001 From: Akshat Agrawal Date: Thu, 9 Jul 2026 18:00:29 +0530 Subject: [PATCH 3/3] fix(nan): Fix bug bounty reported and discovered vulnerabilities in NAN Rx --- components/esp_wifi/lib | 2 +- components/esp_wifi/wifi_apps/nan_app/src/nan_app.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib index 51d25c5309b..7cd4d7b2b4a 160000 --- a/components/esp_wifi/lib +++ b/components/esp_wifi/lib @@ -1 +1 @@ -Subproject commit 51d25c5309b92a3cb285657c291df00c7e758cee +Subproject commit 7cd4d7b2b4acc38aead43b029ac9409c3eba9c54 diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c index c70e1f9ac5f..07e78c69868 100644 --- a/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c +++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_app.c @@ -2230,7 +2230,7 @@ uint8_t esp_wifi_nan_publish_service(const wifi_nan_publish_cfg_t *publish_cfg) } #ifdef CONFIG_ESP_WIFI_NAN_PAIRING - if (cfg->pairing && nan_check_paired_service_hash(service_id)) { + if (cfg->pairing && cfg->pairing->npk_nik_caching && nan_check_paired_service_hash(service_id)) { cfg->pairing->pairing_setup = false; } #endif @@ -2412,7 +2412,7 @@ uint8_t esp_wifi_nan_subscribe_service(const wifi_nan_subscribe_cfg_t *subscribe } #ifdef CONFIG_ESP_WIFI_NAN_PAIRING - if (cfg->pairing && nan_check_paired_service_hash(service_id)) { + if (cfg->pairing && cfg->pairing->npk_nik_caching && nan_check_paired_service_hash(service_id)) { cfg->pairing->pairing_setup = false; } #endif