blackbeard420/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf synced 2025-03-10 01:29:21 -04:00
Code Issues Projects Releases Wiki Activity

fix(esp_wifi): fixed Stack corruption in DPP task

Browse Source
This commit is contained in:
Kapil Gupta 2025-02-12 21:22:25 +05:30
parent a64056fac2
commit 698392735c
1 changed files with 9 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
components/wpa_supplicant/esp_supplicant/src/esp_dpp.c
View File

@ -42,15 +42,11 @@ struct action_rx_param {
esp_err_t esp_dpp_post_evt(uint32_t evt_id, uint32_t data) esp_err_t esp_dpp_post_evt(uint32_t evt_id, uint32_t data)
{ {
dpp_event_t *evt = os_zalloc(sizeof(dpp_event_t)); dpp_event_t evt;
esp_err_t ret = ESP_OK; esp_err_t ret = ESP_OK;
if (evt == NULL) { evt.id = evt_id;
ret = ESP_ERR_NO_MEM; evt.data = data;
goto end;
}
evt->id = evt_id;
evt->data = data;
if (s_dpp_api_lock) { if (s_dpp_api_lock) {
DPP_API_LOCK(); DPP_API_LOCK();
} else { } else {
@ -69,9 +65,6 @@ esp_err_t esp_dpp_post_evt(uint32_t evt_id, uint32_t data)
return ret; return ret;
end: end:
if (evt) {
os_free(evt);
}
wpa_printf(MSG_ERROR, "DPP: Failed to send event %d to DPP task", evt_id); wpa_printf(MSG_ERROR, "DPP: Failed to send event %d to DPP task", evt_id);
return ret; return ret;
} }
@ -518,17 +511,16 @@ static esp_err_t esp_dpp_rx_action(struct action_rx_param *rx_param)
static void esp_dpp_task(void *pvParameters) static void esp_dpp_task(void *pvParameters)
{ {
dpp_event_t *evt; dpp_event_t evt;
bool task_del = false; bool task_del = false;
for (;;) { for (;;) {
if (os_queue_recv(s_dpp_evt_queue, &evt, OS_BLOCK) == TRUE) { if (os_queue_recv(s_dpp_evt_queue, &evt, OS_BLOCK) == TRUE) {
if (evt->id >= SIG_DPP_MAX) { if (evt.id >= SIG_DPP_MAX) {
os_free(evt);
continue; continue;
} }
switch (evt->id) { switch (evt.id) {
case SIG_DPP_DEL_TASK: case SIG_DPP_DEL_TASK:
struct dpp_bootstrap_params_t *params = &s_dpp_ctx.bootstrap_params; struct dpp_bootstrap_params_t *params = &s_dpp_ctx.bootstrap_params;
eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL); eloop_cancel_timeout(esp_dpp_auth_conf_wait_timeout, NULL, NULL);
@ -549,7 +541,7 @@ static void esp_dpp_task(void *pvParameters)
break; break;
case SIG_DPP_BOOTSTRAP_GEN: { case SIG_DPP_BOOTSTRAP_GEN: {
char *command = (char *)evt->data; char *command = (char *)evt.data;
const char *uri; const char *uri;
s_dpp_ctx.id = dpp_bootstrap_gen(s_dpp_ctx.dpp_global, command); s_dpp_ctx.id = dpp_bootstrap_gen(s_dpp_ctx.dpp_global, command);
@ -561,7 +553,7 @@ static void esp_dpp_task(void *pvParameters)
break; break;
case SIG_DPP_RX_ACTION: { case SIG_DPP_RX_ACTION: {
esp_dpp_rx_action((struct action_rx_param *)evt->data); esp_dpp_rx_action((struct action_rx_param *)evt.data);
} }
break; break;
@ -588,7 +580,7 @@ static void esp_dpp_task(void *pvParameters)
break; break;
case SIG_DPP_START_NET_INTRO: { case SIG_DPP_START_NET_INTRO: {
esp_dpp_start_net_intro_protocol((uint8_t*)evt->data); esp_dpp_start_net_intro_protocol((uint8_t*)evt.data);
} }
break; break;
@ -605,8 +597,6 @@ static void esp_dpp_task(void *pvParameters)
break; break;
} }
os_free(evt);
if (task_del) { if (task_del) {
break; break;
} }