In handle_session_command1(), if the second psa_cipher_update()
call (encrypting the device verify data to send back to the client)
fails, the error path only frees the outbuf ciphertext buffer. The
out (Sec1Payload) and out_resp (SessionResp1) structures allocated
just before it are never freed, and neither the cipher operation
(cur_session->ctx_aes) nor the imported key (key_id) are released.
The caller (sec1_req_handler(), via sec1_session_setup()) returns
immediately on a non-ESP_OK result without doing any cleanup of its
own here - sec1_session_setup_cleanup() only runs on the success
path, once resp->sec1 has actually been assigned - so nothing else
ever frees these on this path.
Add psa_cipher_abort()/psa_destroy_key() and free() for out/out_resp,
matching the cleanup already done for every other failure branch
earlier in this same function.
Fixes#18804
Signed-off-by: yi chen <94xhn1@gmail.com>
Add a malloc NULL check in esp_netif_br_glue_add_port and stop freeing
the existing port list when realloc fails. Validate the mac argument in
esp_netif_set_mac and config->base in esp_netif_new_api before use.
fix(drivers): harden multiple peripheral drivers against local DoS and memory corruption
Closes SEC-1183, SEC-1181, SEC-1191, SEC-1120, SEC-1154, SEC-1138, SEC-1136, and SEC-1140
See merge request espressif/esp-idf!50203
Move per-target GPSPI regdma retention descriptors out of esp_hal_gpspi
and
into esp_driver_spi so the driver owns its backup scope and restore
sequence.
Move MWDT retention descriptors out of esp_hal_wdt and into esp_system
so the backup policy lives with the watchdog users, while keeping the
per-chip retention sources under the existing port/soc target
directories.
Guard start_command_read_blocks against cards that place TOKEN_BLOCK_START so early that extra_data_size exceeds the bytes expected on the current iteration. Without this check, the unsigned subtraction for will_receive underflows and propagates into memset, SPI transaction length, and memcpy counts against the fixed 516-byte block buffer.
spi_slave_queue_trans calls spi_slave_setup_priv_trans to allocate
DMA buffers, then tries xQueueSend. If the queue is full the function
returns ESP_ERR_TIMEOUT without freeing those buffers, leaking up to
2 * max_transfer_sz per failed call. Call spi_slave_uninstall_priv_trans
before returning the timeout.
jpeg_acquire_codec_handle acquires s_jpeg_platform.mutex at entry
but two ESP_RETURN_ON_* macros (semaphore-create and PM-lock-create
failure) return without releasing it. Replace with ESP_GOTO_ON_*
that jumps to a cleanup label which frees partial resources, NULLs
the codec pointer, and releases the mutex.
ESP_RETURN_ON_ERROR inside the s_i2c_platform.mutex critical section
returns without releasing the mutex, permanently blocking all I2C
bus operations. Replace with ESP_GOTO_ON_ERROR that jumps to a
cleanup label releasing the mutex before return.
CSI_FSM_INIT is 1, but the controller struct is zero-allocated.
Any failure before the former csi_fsm assignment (near the end of
esp_cam_new_csi_ctlr) jumped to err: which called s_del_csi_ctlr.
That function bailed out immediately because csi_fsm == 0, leaking
the claimed slot, queue, bridge, DMA channel, PM lock, and backup
buffer. Move csi_fsm = CSI_FSM_INIT right after a successful claim
so the err: path properly tears down all allocated resources.
zhiweijian
Wang Meng Yang
morris
Renz Christian Bagaporo
yi chen
Euripedes Rocha
Martin Vychodil
Shreyas Sheth
hebinglin
Wu Zheng Hui
Hu Rui
Jiang Jiang Jian
yangfeng
Xu Si Yu
Zhang Wen Xu