mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
f23fd35207
After processing an esp_event_handler_cleanup sentinel, execution fell through into the regular dispatch block. Every loop-level (ANY_BASE/ ANY_ID) handler was invoked with base="cleanup" and event_data pointing at the internal esp_event_remove_handler_context_t struct. Consequences: - Information disclosure: internal handler addresses and loop instance pointer are exposed to every loop-level handler. - UAF: if a handler stores event_data for later use, post_instance_delete frees the ctx, turning the stored pointer into a dangling reference. - Logic corruption: handlers that switch on base with a default branch misbehave on every unregister anywhere in the system. Fix: wrap the regular dispatch block in an else clause so it is skipped entirely for cleanup events. post_instance_delete, ticks accounting, and xSemaphoreGiveRecursive remain in the shared tail executed for both paths. Closes SEC_221