From dfbe0cb5f1801c09fa15e8320d497641486f9fb8 Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Tue, 14 Apr 2026 11:05:51 +0530 Subject: [PATCH] fix(protocomm): pass current session id when closing existing session sec1_new_session()/sec2_new_session() were calling sec*_close_session() with the *new* session_id parameter instead of the existing cur_session->id. The close handler validates `cur_session->id == session_id` before performing teardown, so the call always failed with ESP_ERR_INVALID_STATE. Effect: when a peer started a new provisioning session while another was already active, the previous session's PSA keys, AES context, SRP handle and username buffer were leaked instead of being destroyed. The cleared session struct was overwritten by the new session, leaking the previous key handles inside PSA Crypto and (for security2) leaking heap memory for the username and SRP context. Fix: pass cur_session->id so the close path actually executes the teardown (psa_destroy_key/psa_cipher_abort/esp_srp_free/free) before the new session takes over. --- components/protocomm/src/security/security1.c | 2 +- components/protocomm/src/security/security2.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/components/protocomm/src/security/security1.c b/components/protocomm/src/security/security1.c index 3197a40729e..afca7a57e86 100644 --- a/components/protocomm/src/security/security1.c +++ b/components/protocomm/src/security/security1.c @@ -501,7 +501,7 @@ static esp_err_t sec1_new_session(protocomm_security_handle_t handle, uint32_t s if (cur_session->id != -1) { /* Only one session is allowed at a time */ ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id); - sec1_close_session(cur_session, session_id); + sec1_close_session(cur_session, cur_session->id); } cur_session->id = session_id; diff --git a/components/protocomm/src/security/security2.c b/components/protocomm/src/security/security2.c index 0bd878f2dd7..895379fceb2 100644 --- a/components/protocomm/src/security/security2.c +++ b/components/protocomm/src/security/security2.c @@ -425,7 +425,7 @@ static esp_err_t sec2_new_session(protocomm_security_handle_t handle, uint32_t s if (cur_session->id != -1) { /* Only one session is allowed at a time */ ESP_LOGE(TAG, "Closing old session with id %" PRIu32, cur_session->id); - sec2_close_session(cur_session, session_id); + sec2_close_session(cur_session, cur_session->id); } cur_session->id = session_id;