From 78bf36db3ea64cddae8e73b1ad7c8ff41e1ab0c6 Mon Sep 17 00:00:00 2001
From: Ashish Sharma <ashish.sharma@espressif.com>
Date: Mon, 7 Sep 2026 10:35:43 +0800
Subject: [PATCH] fix(esp_crt_bundle): match memory allocator in cross-signed
 callback

Closes https://github.com/espressif/esp-idf/issues/19053
---
 components/mbedtls/esp_crt_bundle/esp_crt_bundle.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c b/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
index 38394021b24..94a07a8ef7f 100644
--- a/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
+++ b/components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
@@ -12,6 +12,7 @@
 #include "esp_log.h"
 
 #include "mbedtls/pk.h"
+#include "mbedtls/platform.h"
 #include "mbedtls/oid.h"
 #include "mbedtls/asn1.h"
 
@@ -520,7 +521,7 @@ static int esp_crt_ca_cb_callback(void *ctx, mbedtls_x509_crt const *child, mbed
     }
     // If we found a matching certificate, we need to allocate a new
     // mbedtls_x509_crt structure and copy the certificate data into it.
-    mbedtls_x509_crt *new_cert = calloc(1, sizeof(mbedtls_x509_crt));
+    mbedtls_x509_crt *new_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
     if (unlikely(new_cert == NULL)) {
         ESP_LOGE(TAG, "Failed to allocate memory for new certificate");
         return MBEDTLS_ERR_X509_ALLOC_FAILED;
@@ -546,7 +547,7 @@ static int esp_crt_ca_cb_callback(void *ctx, mbedtls_x509_crt const *child, mbed
     if (ret != 0) {
         ESP_LOGE(TAG, "Failed to parse public key from certificate: %d", ret);
         mbedtls_x509_crt_free(new_cert);
-        free(new_cert);
+        mbedtls_free(new_cert);
         return ret;
     }
 
@@ -556,24 +557,24 @@ static int esp_crt_ca_cb_callback(void *ctx, mbedtls_x509_crt const *child, mbed
     if (esp_crt_ref_asn1(child_issuer, parent_subject) != 0) {
         ESP_LOGE(TAG, "Failed to reference ASN.1 data");
         mbedtls_x509_crt_free(new_cert);
-        free(new_cert);
+        mbedtls_free(new_cert);
         return MBEDTLS_ERR_X509_ALLOC_FAILED;
     }
 
     child_issuer = child_issuer->next;
     while (child_issuer != NULL) {
-        parent_subject->next = calloc(1, sizeof(mbedtls_asn1_named_data));
+        parent_subject->next = mbedtls_calloc(1, sizeof(mbedtls_asn1_named_data));
         if (parent_subject->next == NULL) {
             ESP_LOGE(TAG, "Failed to allocate memory for subject node");
             mbedtls_x509_crt_free(new_cert);
-            free(new_cert);
+            mbedtls_free(new_cert);
             return MBEDTLS_ERR_X509_ALLOC_FAILED;
         }
         parent_subject = parent_subject->next;
         if (esp_crt_ref_asn1(child_issuer, parent_subject) != 0) {
             ESP_LOGE(TAG, "Failed to reference ASN.1 data");
             mbedtls_x509_crt_free(new_cert);
-            free(new_cert);
+            mbedtls_free(new_cert);
             return MBEDTLS_ERR_X509_ALLOC_FAILED;
         }
         child_issuer = child_issuer->next;