Merge branch 'fix/fix_ws_server_subprotocols_null_dereference_v5.4' into 'release/v5.4'

fix: fixes websocket server possible null dereference (v5.4)

See merge request espressif/esp-idf!46919

components/esp_http_server/test_apps/main/test_http_server.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -8,6 +8,7 @@
 #include <stdbool.h>
 #include <esp_system.h>
 #include <esp_http_server.h>
+#include <esp_heap_caps.h>
 
 #include "unity.h"
 #include "test_utils.h"
@@ -31,6 +32,21 @@ httpd_uri_t handler_limit_uri (char* path)
     return uri;
 };
 
+#ifdef CONFIG_HTTPD_WS_SUPPORT
+static httpd_uri_t handler_limit_ws_uri(char *path, const char *subprotocol)
+{
+    httpd_uri_t uri = {
+        .uri                   = path,
+        .method                = HTTP_GET,
+        .handler               = null_func,
+        .user_ctx              = NULL,
+        .is_websocket          = true,
+        .supported_subprotocol = subprotocol,
+    };
+    return uri;
+}
+#endif /* CONFIG_HTTPD_WS_SUPPORT */
+
 static inline unsigned num_digits(unsigned x)
 {
     unsigned digits = 1;
@@ -81,6 +97,36 @@ void test_handler_limit(httpd_handle_t hd)
         TEST_ASSERT(httpd_unregister_uri_handler(hd, uris[i].uri, uris[i].method) == ESP_OK);
     }
     basic_sanity = false;
+
+#ifdef CONFIG_HTTPD_WS_SUPPORT
+    /* --- WS subprotocol memory leak check ---
+     * Each registration strdup's the supported_subprotocol string.
+     * Verify that unregistration frees it (expected leak per handler:
+     * strlen(subprotocol) + 1 bytes if the bug is present).
+     */
+    char ws_paths[HTTPD_TEST_MAX_URI_HANDLERS][8];
+    httpd_uri_t ws_uris[HTTPD_TEST_MAX_URI_HANDLERS];
+    const char *subprotocol = "chat";
+
+    for (i = 0; i < HTTPD_TEST_MAX_URI_HANDLERS; i++) {
+        sprintf(ws_paths[i], "/ws%d", i);
+        ws_uris[i] = handler_limit_ws_uri(ws_paths[i], subprotocol);
+    }
+
+    size_t heap_before = heap_caps_get_free_size(MALLOC_CAP_8BIT);
+
+    for (i = 0; i < HTTPD_TEST_MAX_URI_HANDLERS; i++) {
+        TEST_ASSERT(httpd_register_uri_handler(hd, &ws_uris[i]) == ESP_OK);
+    }
+    for (i = 0; i < HTTPD_TEST_MAX_URI_HANDLERS; i++) {
+        TEST_ASSERT(httpd_unregister_uri_handler(hd, ws_uris[i].uri, ws_uris[i].method) == ESP_OK);
+    }
+
+    size_t heap_after = heap_caps_get_free_size(MALLOC_CAP_8BIT);
+    int leaked = (int)heap_before - (int)heap_after;
+
+    TEST_ASSERT_MESSAGE(leaked <= 0, "Heap leaked after WS handler unregister");
+#endif /* CONFIG_HTTPD_WS_SUPPORT */
 }
 
 /********************* Test Handler Limit End *******************/

components/esp_http_server/test_apps/sdkconfig.defaults

@@ -7,3 +7,4 @@ CONFIG_COMPILER_STACK_CHECK_MODE_STRONG=y
 CONFIG_COMPILER_STACK_CHECK=y
 
 CONFIG_ESP_TASK_WDT_EN=n
+CONFIG_HTTPD_WS_SUPPORT=y