The reassembly buffer must be reset to its origin at the beginning of every
transaction. prov_msg_recv() pulls the PDU type byte (advancing buf->data by
one) and nothing restores it between transactions. Without this reset,
buf->data drifts forward by one byte per received PDU, causing the segment-0
memcpy to write past the end of the statically allocated rx buffer
(PROV_RX_BUF_SIZE), and the XACT_SEG_DATA() offsets used for continuation
segments to be skewed by the accumulated drift.
Fix multiple wire-format and robustness issues in the DFD client
(dfd_cli.c):
- handle_capabilities: read oob_retrieval_supported as u8 instead of
le32. The server encodes a single byte; le32 over-consumed 3 bytes
of the URL scheme list and could over-read the buffer.
- handle_upload_status: extract upload_progress from bits 0-6 (& 0x7F)
and upload_type from bit 7 (>> 7), matching the server encoding
(progress | BIT(7)). The previous >>1 / &0x01 returned wrong values,
mis-classified in-band vs OOB, and falsely rejected valid OOB
messages with high progress.
- handle_dfd_status: correct the transfer-mode byte layout to
trans_mode bits 0-1, update_policy bit 2, RFU bits 3-7 (previously
read bits 6-7 / 5), and fix the RFU mask to 0xF8. Now matches the
struct bitfield definition and the DFD server.
- handle_dfd_status: report status+phase and return early when
buf->len == 0 (IDLE phase) instead of pulling 10 absent bytes.
- bt_mesh_dfd_cli_distribution_start: encode trans_mode/update_policy
into bits 0-2 so the server decodes them correctly.
- handle_receiver_list: validate buf->len >= entries_cnt * 5 before
the loop, and handle entries_cnt == 0 without relying on calloc(0).
- handle_receiver_status: pass the status value (not the whole union)
to the %d log format, fixing undefined behavior.
- dfd_client_recv_status: drop the dead BLE_MESH_DFD_OP_CAPABILITIES_GET
case (a client-send opcode) from the receive switch.
- bt_mesh_dfd_cli_receivers_add: widen msg_length to uint32_t to avoid
uint16_t overflow that bypassed the PDU size guard; add a NULL check
for the receivers array.
- bt_mesh_dfd_cli_distribution_upload_oob_start: return -EINVAL
instead of -1 for consistency with the rest of the file.
On the Linux port, tasks are pthreads that cannot be forcibly paused;
the scheduler "unschedules" a task only by selecting a different next
task, and the outgoing task keeps running until it next blocks itself
in event_wait (e.g. via vPortYield). If the scheduler later switches
back into such a task (event_signal) before it ever parked in
event_wait, that wake is never consumed and event_triggered stays
latched. The task's next voluntary block then returns immediately
instead of blocking (e.g. vTaskDelay(100ms) returning in 0ms), which
desynchronizes kernel and port scheduling state.
Clear the outgoing task's pending event when switching to a different
task, under s_port_mutex and atomically with the scheduling decision.
Any latched-but-unconsumed wake is stale at that point; a legitimate
wake can only be delivered later, once the scheduler selects the task
again as next_thread.
Add event_clear() to the wait_for_event helper to support this.
Verified: minimal repros (busy-wait with another ready task, and
pthread-blocked task) now measure 92-101 ms for vTaskDelay(100ms)
instead of 0 ms; linux_freertos kernel test app 18/18 pass; the
previously failing esp_linenoise host test suite passes 34/34.
In httpd_parse.c, cb_headers_complete() converted the HTTP parser's
content_length (uint64_t) to the request's content_len (size_t) via an
unsafe cast through (int). On a 32-bit size_t target a Content-Length
above 4 GiB silently truncated, enabling request smuggling where the
server and an upstream proxy disagree on the body length (CWE-681).
Reject any Content-Length above UINT32_MAX with 413 Content Too Large
before any handler runs. UINT32_MAX is the largest body length the
server can represent in size_t content_len on every target, so this is
the maximum the server can support; no configuration knob is needed.
Closes SEC-102
Closes SEC-229
Drop the internal assert in dac_continuous_enable() and call
dac_priv_enable_channel() directly, since the surrounding state
machine already guarantees the preconditions.
Co-authored-by: Cursor <cursoragent@cursor.com>
GCC 16 flags the volatile accumulator in the cache writeback loops even
though it is volatile, as it is only used to update itself. Drop the
accumulator and rely on the volatile-qualified psram pointer to keep
the cache-line reads from being optimized out.
GCC 16 raised the default level of -Wunused-but-set-variable and now
flags variables that are only used to update themselves. Remove the
'removed' counter in pmksa_cache_flush() (its only read was commented
out) and mark the EAP-FAST PAC entry counters as unused, since their
only read is inside wpa_printf(MSG_DEBUG, ...) which compiles to a
no-op when debug logging is disabled.
The six key-material hexdumps (ND-IGTK/BIGTK/TK/GTK and the peer IGTK/BIGTK)
kept a leftover '##' dev-grep marker on their tag string. Drop it; the
descriptive labels stay and the dumps remain at ESP_LOG_DEBUG.
