From 87dbc6ec3cb7c84ee4313593b65af7852524e2dc Mon Sep 17 00:00:00 2001 From: Euripedes Rocha Filho Date: Thu, 2 Jul 2026 14:58:28 +0200 Subject: [PATCH] fix(esp_netif): harden NULL and OOM handling in netif APIs Add a malloc NULL check in esp_netif_br_glue_add_port and stop freeing the existing port list when realloc fails. Validate the mac argument in esp_netif_set_mac and config->base in esp_netif_new_api before use. --- components/esp_netif/lwip/esp_netif_br_glue.c | 9 +++++---- components/esp_netif/lwip/esp_netif_lwip.c | 4 ++++ 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/components/esp_netif/lwip/esp_netif_br_glue.c b/components/esp_netif/lwip/esp_netif_br_glue.c index 5425cfe013b..55a5cc9fa67 100644 --- a/components/esp_netif/lwip/esp_netif_br_glue.c +++ b/components/esp_netif/lwip/esp_netif_br_glue.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -328,12 +328,13 @@ esp_err_t esp_netif_br_glue_add_port(esp_netif_br_glue_handle_t netif_br_glue, e { if (netif_br_glue->ports_esp_netifs == NULL) { netif_br_glue->ports_esp_netifs = malloc(sizeof(esp_netif_t *)); + if (netif_br_glue->ports_esp_netifs == NULL) { + ESP_LOGE(TAG, "no memory to add br port"); + return ESP_ERR_NO_MEM; + } } else { esp_netif_t **new_ports = realloc(netif_br_glue->ports_esp_netifs, (netif_br_glue->port_cnt + 1) * sizeof(esp_netif_t *)); if (new_ports == NULL) { - free(netif_br_glue->ports_esp_netifs); - netif_br_glue->ports_esp_netifs = NULL; - netif_br_glue->port_cnt = 0; ESP_LOGE(TAG, "no memory to add br port"); return ESP_ERR_NO_MEM; } diff --git a/components/esp_netif/lwip/esp_netif_lwip.c b/components/esp_netif/lwip/esp_netif_lwip.c index aacbb344237..92651de53c5 100644 --- a/components/esp_netif/lwip/esp_netif_lwip.c +++ b/components/esp_netif/lwip/esp_netif_lwip.c @@ -801,6 +801,7 @@ static esp_err_t esp_netif_new_api(esp_netif_api_msg_t *msg) const esp_netif_config_t *esp_netif_config = msg->data; // mandatory configuration must be provided when creating esp_netif object if (esp_netif_config == NULL || + esp_netif_config->base == NULL || esp_netif_config->base->if_key == NULL || NULL != esp_netif_get_handle_from_ifkey_unsafe(esp_netif_config->base->if_key)) { ESP_LOGE(TAG, "%s: Failed to configure netif with config=%p (config or if_key is NULL or duplicate key)", @@ -1146,6 +1147,9 @@ esp_err_t esp_netif_set_mac_api(esp_netif_api_msg_t *msg) esp_err_t esp_netif_set_mac(esp_netif_t *esp_netif, uint8_t mac[]) { + if (mac == NULL) { + return ESP_ERR_INVALID_ARG; + } if (esp_netif == NULL || esp_netif->lwip_netif == NULL) { return ESP_ERR_ESP_NETIF_IF_NOT_READY; }