feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

Merge branch 'fix/lwip_dhcps_fuzz' into 'master'

Browse Source 
[lwip]: Fix dhcp server minor issues found when fuzzing

See merge request espressif/esp-idf!42315
This commit is contained in:
David Čermák
2025-10-24 04:41:24 +08:00
parent 06004072cb 4709069e13
commit 4a59e94b4e
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/lwip/apps/dhcpserver/dhcpserver.c
+18 -14
View File
@@ -65,7 +65,9 @@
#define DHCP_OPTION_END 255
//#define USE_CLASS_B_NET 1
#ifndef DHCPS_DEBUG
#define DHCPS_DEBUG 0
#endif
#define DHCPS_LOG printf
#define IS_INVALID_SUBNET_MASK(x) (((x-1) | x) != 0xFFFFFFFF)
@@ -191,7 +193,7 @@ void dhcps_delete(dhcps_t *dhcps)
dhcps->state = DHCPS_HANDLE_DELETE_PENDING;
} else {
// otherwise, we're free to delete the handle immediately
free(dhcps);
mem_free(dhcps);
}
}
}
@@ -892,7 +894,9 @@ static void send_ack(dhcps_t *dhcps, struct dhcps_msg *m, u16_t len)
#endif
if (SendAck_err_t == ERR_OK) {
dhcps->dhcps_cb(dhcps->dhcps_cb_arg, m->yiaddr, m->chaddr);
if (dhcps->dhcps_cb) {
dhcps->dhcps_cb(dhcps->dhcps_cb_arg, m->yiaddr, m->chaddr);
}
}
if (p->ref != 0) {
@@ -1137,12 +1141,12 @@ POOL_CHECK:
if ((dhcps->client_address.addr > dhcps->dhcps_poll.end_ip.addr) || (ip4_addr_isany(&dhcps->client_address))) {
if (pnode != NULL) {
node_remove_from_list(&dhcps->plist, pnode);
free(pnode);
mem_free(pnode);
pnode = NULL;
}
if (pdhcps_pool != NULL) {
free(pdhcps_pool);
mem_free(pdhcps_pool);
pdhcps_pool = NULL;
}
@@ -1154,12 +1158,12 @@ POOL_CHECK:
if (ret == DHCPS_STATE_RELEASE || ret == DHCPS_STATE_NAK || ret == DHCPS_STATE_DECLINE) {
if (pnode != NULL) {
node_remove_from_list(&dhcps->plist, pnode);
free(pnode);
mem_free(pnode);
pnode = NULL;
}
if (pdhcps_pool != NULL) {
free(pdhcps_pool);
mem_free(pdhcps_pool);
pdhcps_pool = NULL;
}
@@ -1323,7 +1327,7 @@ static void handle_dhcp(void *arg,
DHCPS_LOG("dhcps: handle_dhcp-> pbuf_free(p)\n");
#endif
pbuf_free(p);
free(pmsg_dhcps);
mem_free(pmsg_dhcps);
pmsg_dhcps = NULL;
}
@@ -1476,9 +1480,9 @@ err_t dhcps_stop(dhcps_t *dhcps, struct netif *netif)
pback_node = pnode;
pnode = pback_node->pnext;
node_remove_from_list(&dhcps->plist, pback_node);
free(pback_node->pnode);
mem_free(pback_node->pnode);
pback_node->pnode = NULL;
free(pback_node);
mem_free(pback_node);
pback_node = NULL;
}
sys_untimeout(dhcps_tmr, dhcps);
@@ -1520,9 +1524,9 @@ static void kill_oldest_dhcps_pool(dhcps_t *dhcps)
} else {
minpre->pnext = minp->pnext;
}
free(minp->pnode);
mem_free(minp->pnode);
minp->pnode = NULL;
free(minp);
mem_free(minp);
minp = NULL;
}
@@ -1537,7 +1541,7 @@ static void dhcps_tmr(void *arg)
dhcps_t *dhcps = arg;
dhcps_handle_state state = dhcps->state;
if (state == DHCPS_HANDLE_DELETE_PENDING) {
free(dhcps);
mem_free(dhcps);
return;
}
@@ -1559,9 +1563,9 @@ static void dhcps_tmr(void *arg)
pback_node = pnode;
pnode = pback_node->pnext;
node_remove_from_list(&dhcps->plist, pback_node);
free(pback_node->pnode);
mem_free(pback_node->pnode);
pback_node->pnode = NULL;
free(pback_node);
mem_free(pback_node);
pback_node = NULL;
} else {
pnode = pnode ->pnext;