espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-30 18:57:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Allocate HTTP header space for async httpd_req_t objects

Browse Source 
This resolves bug #13430 by allocating a new copy of resp_hdrs
when calling httpd_req_async_handler_begin(), thus preventing
invalid access to memory from async tasks.
This commit is contained in:
Mooneer Salem
2024-03-24 20:12:42 -07:00
committed by David Cermak
parent 3559e5702f
commit 4951df6fcc
1 changed files with 64 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
components/esp_http_server/src/httpd_txrx.c
View File

@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2018-2021 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@ -575,6 +575,19 @@ esp_err_t httpd_req_async_handler_begin(httpd_req_t *r, httpd_req_t **out)
}
memcpy(async->aux, r->aux, sizeof(struct httpd_req_aux));
// Copy response header block
struct httpd_data *hd = (struct httpd_data *) r->handle;
struct httpd_req_aux *async_aux = (struct httpd_req_aux *) async->aux;
struct httpd_req_aux *r_aux = (struct httpd_req_aux *) r->aux;
async_aux->resp_hdrs = calloc(hd->config.max_resp_headers, sizeof(struct resp_hdr));
if (async_aux->resp_hdrs == NULL) {
free(async_aux);
free(async);
return ESP_ERR_NO_MEM;
}
memcpy(async_aux->resp_hdrs, r_aux->resp_hdrs, hd->config.max_resp_headers * sizeof(struct resp_hdr));
// mark socket as "in use"
struct httpd_req_aux *ra = r->aux;
ra->sd->for_async_req = true;
@ -593,6 +606,7 @@ esp_err_t httpd_req_async_handler_complete(httpd_req_t *r)
struct httpd_req_aux *ra = r->aux;
ra->sd->for_async_req = false;
free(ra->resp_hdrs);
free(r->aux);
free(r);
@ -619,7 +633,7 @@ static int httpd_sock_err(const char *ctx, int sockfd)
int errval;
ESP_LOGW(TAG, LOG_FMT("error in %s : %d"), ctx, errno);
switch(errno) {
switch (errno) {
case EAGAIN:
case EINTR:
errval = HTTPD_SOCK_ERR_TIMEOUT;