On the Linux port, tasks are pthreads that cannot be forcibly paused;
the scheduler "unschedules" a task only by selecting a different next
task, and the outgoing task keeps running until it next blocks itself
in event_wait (e.g. via vPortYield). If the scheduler later switches
back into such a task (event_signal) before it ever parked in
event_wait, that wake is never consumed and event_triggered stays
latched. The task's next voluntary block then returns immediately
instead of blocking (e.g. vTaskDelay(100ms) returning in 0ms), which
desynchronizes kernel and port scheduling state.
Clear the outgoing task's pending event when switching to a different
task, under s_port_mutex and atomically with the scheduling decision.
Any latched-but-unconsumed wake is stale at that point; a legitimate
wake can only be delivered later, once the scheduler selects the task
again as next_thread.
Add event_clear() to the wait_for_event helper to support this.
Verified: minimal repros (busy-wait with another ready task, and
pthread-blocked task) now measure 92-101 ms for vTaskDelay(100ms)
instead of 0 ms; linux_freertos kernel test app 18/18 pass; the
previously failing esp_linenoise host test suite passes 34/34.
In httpd_parse.c, cb_headers_complete() converted the HTTP parser's
content_length (uint64_t) to the request's content_len (size_t) via an
unsafe cast through (int). On a 32-bit size_t target a Content-Length
above 4 GiB silently truncated, enabling request smuggling where the
server and an upstream proxy disagree on the body length (CWE-681).
Reject any Content-Length above UINT32_MAX with 413 Content Too Large
before any handler runs. UINT32_MAX is the largest body length the
server can represent in size_t content_len on every target, so this is
the maximum the server can support; no configuration knob is needed.
Closes SEC-102
Closes SEC-229
Drop the internal assert in dac_continuous_enable() and call
dac_priv_enable_channel() directly, since the surrounding state
machine already guarantees the preconditions.
Co-authored-by: Cursor <cursoragent@cursor.com>
GCC 16 flags the volatile accumulator in the cache writeback loops even
though it is volatile, as it is only used to update itself. Drop the
accumulator and rely on the volatile-qualified psram pointer to keep
the cache-line reads from being optimized out.
GCC 16 raised the default level of -Wunused-but-set-variable and now
flags variables that are only used to update themselves. Remove the
'removed' counter in pmksa_cache_flush() (its only read was commented
out) and mark the EAP-FAST PAC entry counters as unused, since their
only read is inside wpa_printf(MSG_DEBUG, ...) which compiles to a
no-op when debug logging is disabled.
The six key-material hexdumps (ND-IGTK/BIGTK/TK/GTK and the peer IGTK/BIGTK)
kept a leftover '##' dev-grep marker on their tag string. Drop it; the
descriptive labels stay and the dumps remain at ESP_LOG_DEBUG.
- Tighten the own GTK Key ID guard from ">3" (which admitted 0 and 3) to
the spec range 1..2 (Wi-Fi Aware v4.0 §7.1.3.2).
- When the Encrypted-Key-Data bit is clear, ignore the Key Data instead of
parsing KDEs from the clear: group KDEs are only ever carried KEK-wrapped
(§7.1.3.5; 802.11-2020 §12.7.2). Also store the peer IPN/BIPN from the
IGTK/BIGTK KDEs for the BIP RX replay-counter seed.
The peer IGTK/BIGTK were installed with an all-zero seq, so the blob's BIP
RX replay counter started at 0 instead of the peer's advertised value. Store
the 6-octet IPN/BIPN from the IGTK/BIGTK KDE (the octets after the 2-byte
Key ID, per 802.11 Fig 12-42/12-47) into the NDL and pass them as the
install seq. The parser side of this lands with the group-KDE guards.
