feedc0de/esp-idf
1
0
Fork 0
forked from espressif/esp-idf
Code Pull Requests Activity

fix(esp_wifi): fixed Stack corruption in DPP task

Browse Source
This commit is contained in:
Kapil Gupta
2025-02-12 21:22:25 +05:30
parent 9fb88f83df
commit 5d9db0b972
1 changed files with 10 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
components/wpa_supplicant/esp_supplicant/src/esp_dpp.c
View File

@@ -40,15 +40,11 @@ struct action_rx_param {
static int esp_dpp_post_evt(uint32_t evt_id, uint32_t data) static int esp_dpp_post_evt(uint32_t evt_id, uint32_t data)
{ {
dpp_event_t *evt = os_zalloc(sizeof(dpp_event_t)); dpp_event_t evt;
int ret = ESP_OK; esp_err_t ret = ESP_OK;
if (evt == NULL) { evt.id = evt_id;
ret = ESP_ERR_NO_MEM; evt.data = data;
goto end;
}
evt->id = evt_id;
evt->data = data;
if (s_dpp_api_lock) { if (s_dpp_api_lock) {
DPP_API_LOCK(); DPP_API_LOCK();
} else { } else {
@@ -67,9 +63,6 @@ static int esp_dpp_post_evt(uint32_t evt_id, uint32_t data)
return ret; return ret;
end: end:
if (evt) {
os_free(evt);
}
wpa_printf(MSG_ERROR, "DPP: Failed to send event %d to DPP task", evt_id); wpa_printf(MSG_ERROR, "DPP: Failed to send event %d to DPP task", evt_id);
return ret; return ret;
} }
@@ -381,17 +374,16 @@ static void esp_dpp_rx_action(struct action_rx_param *rx_param)
static void esp_dpp_task(void *pvParameters ) static void esp_dpp_task(void *pvParameters )
{ {
dpp_event_t *evt; dpp_event_t evt;
bool task_del = false; bool task_del = false;
for (;;) { for (;;) {
if (os_queue_recv(s_dpp_evt_queue, &evt, OS_BLOCK) == TRUE) { if (os_queue_recv(s_dpp_evt_queue, &evt, OS_BLOCK) == TRUE) {
if (evt->id >= SIG_DPP_MAX) { if (evt.id >= SIG_DPP_MAX) {
os_free(evt);
continue; continue;
} }
switch (evt->id) { switch (evt.id) {
case SIG_DPP_DEL_TASK: case SIG_DPP_DEL_TASK:
struct dpp_bootstrap_params_t *params = &s_dpp_ctx.bootstrap_params; struct dpp_bootstrap_params_t *params = &s_dpp_ctx.bootstrap_params;
eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL); eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL);
@@ -412,7 +404,7 @@ static void esp_dpp_task(void *pvParameters )
break; break;
case SIG_DPP_BOOTSTRAP_GEN: { case SIG_DPP_BOOTSTRAP_GEN: {
char *command = (char *)evt->data; char *command = (char *)evt.data;
const char *uri; const char *uri;
s_dpp_ctx.id = dpp_bootstrap_gen(s_dpp_ctx.dpp_global, command); s_dpp_ctx.id = dpp_bootstrap_gen(s_dpp_ctx.dpp_global, command);
@@ -424,7 +416,7 @@ static void esp_dpp_task(void *pvParameters )
break; break;
case SIG_DPP_RX_ACTION: { case SIG_DPP_RX_ACTION: {
esp_dpp_rx_action((struct action_rx_param *)evt->data); esp_dpp_rx_action((struct action_rx_param *)evt.data);
} }
break; break;
@@ -462,8 +454,6 @@ static void esp_dpp_task(void *pvParameters )
break; break;
} }
os_free(evt);
if (task_del) { if (task_del) {
break; break;
} }