From b1d6c723f202cd5d1e41c73c44c5cfbeb72316d5 Mon Sep 17 00:00:00 2001 From: Euripedes Rocha Filho Date: Thu, 2 Jul 2026 15:53:21 +0200 Subject: [PATCH] fix(esp_netif): harden NULL and OOM handling in netif APIs Use a temporary pointer for br_glue port-list realloc so a failure does not clobber the existing array. Reject NULL mac in esp_netif_set_mac and validate config->base in esp_netif_new_api before use. Co-authored-by: Cursor --- components/esp_netif/lwip/esp_netif_br_glue.c | 17 +++++++++++------ components/esp_netif/lwip/esp_netif_lwip.c | 4 ++++ 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/components/esp_netif/lwip/esp_netif_br_glue.c b/components/esp_netif/lwip/esp_netif_br_glue.c index c9d122c0a0e..21a494cf90c 100644 --- a/components/esp_netif/lwip/esp_netif_br_glue.c +++ b/components/esp_netif/lwip/esp_netif_br_glue.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2022-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -333,12 +333,17 @@ esp_err_t esp_netif_br_glue_add_port(esp_netif_br_glue_handle_t netif_br_glue, e { if (netif_br_glue->ports_esp_netifs == NULL) { netif_br_glue->ports_esp_netifs = malloc(sizeof(esp_netif_t *)); + if (netif_br_glue->ports_esp_netifs == NULL) { + ESP_LOGE(TAG, "no memory to add br port"); + return ESP_ERR_NO_MEM; + } } else { - netif_br_glue->ports_esp_netifs = realloc(netif_br_glue->ports_esp_netifs, (netif_br_glue->port_cnt + 1) * sizeof(esp_netif_t *)); - } - if (!netif_br_glue->ports_esp_netifs) { - ESP_LOGE(TAG, "no memory to add br port"); - return ESP_ERR_NO_MEM; + esp_netif_t **new_ports = realloc(netif_br_glue->ports_esp_netifs, (netif_br_glue->port_cnt + 1) * sizeof(esp_netif_t *)); + if (new_ports == NULL) { + ESP_LOGE(TAG, "no memory to add br port"); + return ESP_ERR_NO_MEM; + } + netif_br_glue->ports_esp_netifs = new_ports; } netif_br_glue->ports_esp_netifs[netif_br_glue->port_cnt] = esp_netif_port; diff --git a/components/esp_netif/lwip/esp_netif_lwip.c b/components/esp_netif/lwip/esp_netif_lwip.c index 2fa2cba888e..c68563befe5 100644 --- a/components/esp_netif/lwip/esp_netif_lwip.c +++ b/components/esp_netif/lwip/esp_netif_lwip.c @@ -713,6 +713,7 @@ static esp_err_t esp_netif_new_api(esp_netif_api_msg_t *msg) const esp_netif_config_t *esp_netif_config = msg->data; // mandatory configuration must be provided when creating esp_netif object if (esp_netif_config == NULL || + esp_netif_config->base == NULL || esp_netif_config->base->if_key == NULL || NULL != esp_netif_get_handle_from_ifkey_unsafe(esp_netif_config->base->if_key)) { ESP_LOGE(TAG, "%s: Failed to configure netif with config=%p (config or if_key is NULL or duplicate key)", @@ -1025,6 +1026,9 @@ esp_err_t esp_netif_set_mac_api(esp_netif_api_msg_t *msg) esp_err_t esp_netif_set_mac(esp_netif_t *esp_netif, uint8_t mac[]) { + if (mac == NULL) { + return ESP_ERR_INVALID_ARG; + } if (esp_netif == NULL || esp_netif->lwip_netif == NULL) { return ESP_ERR_ESP_NETIF_IF_NOT_READY; }