A blocking transport read can return zero when no data arrives before
timeout. Passing that zero length to http_parser_execute signals EOF while
a response is incomplete, puts the parser in HPE_INVALID_EOF_STATE, and
causes later response bytes to be discarded. The shortened response can
then be treated as successful.
Skip parser execution for every zero-length transport read, not only async
reads. Also compare the raw esp_transport_read result against raw
ERR_TCP_TRANSPORT values so timeout and peer-close failures retain their
documented HTTP error classifications.
A standalone reproduction built with the unmodified HTTP parser showed the
blocking timeout transition to HPE_INVALID_EOF_STATE and loss of the
remaining 15 bytes. Skipping the zero-length parser call delivered the full
chunk and message-complete callback.
Disclosure: this fix was prepared with AI assistance (Claude) and reviewed by me before submission.
Constraint: esp_http_client_get_data returns raw transport result values before esp_transport_translate_error.
Rejected: Keep the async-only zero-length guard | blocking transport reads also return zero on timeout.
Confidence: high
Scope-risk: moderate
Directive: Do not pass a transient zero-length transport read to the HTTP parser as EOF.
Tested: standalone blocking mid-chunk timeout reproduction; source-only duplicate-comment cleanup; git diff --check
Not-tested: hardware TLS transport integration
Signed-off-by: yi chen <94xhn1@gmail.com>
Add ESP_KEY_SOURCE_BUFFER and ESP_KEY_SOURCE_PSA key sources so all
hardware backends (DS, ECDSA, secure element) are accessed via PSA
key IDs through a single esp_tls_cfg_t.client_key field.
(cherry picked from commit 36090b7161)
esp_http_client_set_redirection() now rejects any redirect target whose
scheme is not https:// when the origin is HTTPS. This catches http, ftp,
ws and any other scheme before client state is mutated. Same-host /
https-to-https redirects are unaffected. Apps that intentionally want
mixed-scheme redirects can set disable_auto_redirect=true and handle
HTTP_EVENT_REDIRECT.
According to RFC 7616, nonce-prime and cnonce-prime is used for SHA-256-sess only and not for SHA-256.
This commit updates the check and uses nonce only for "-sess" algorithms.
Regression from 66995965e7
Fixed vulnerability where malicious HTTP servers could trigger OOB reads
by sending empty or very short algorithm fields in WWW-Authenticate headers.
Changes:
- Replace unsafe memcmp() with strcasecmp() for algorithm comparison
- Add algorithm NULL validation at function entry point
- Fix duplicate md5-sess check, add missing SHA-256 check
This commit updated the client closing condition to avoid spurious
dispatching of event HTTP_EVENT_DISCONNECTED while closing closeed connection.
Closes https://github.com/espressif/esp-idf/issues/16070
This commit added new http state HTTP_STATE_CONNECTING, and made states public.
Also added public API to get current state.
Updated state flow in esp_http_client_perform()
Closes https://github.com/espressif/esp-idf/issues/16019
Fixed memory leak in esp_http_client_cleanup() where current_header_value
buffer was not being freed when ESP_ERR_HTTP_FETCH_HEADER is returned
during header parsing failures.
This commit fixes an issue encountered during OTA when partial download
is enabled using an AWS signed URL restricted to GET requests.
It also adds an API to retrieve the OTA image size from the Content-Range header.
