Skip to content

Commit

Permalink
Fix several possible double free() in ESP32 network_driver.c
Browse files Browse the repository at this point in the history
Removes several possible uses of free() on memory that had been previously free'd. This would
happen under specific error conditions in the `start_network` function in network_driver.c
that `network:start/1` uses to configure and start the network.

Signed-off-by: Winford <winford@object.stream>
  • Loading branch information
UncleGrumpy committed Jun 4, 2024
1 parent 1a52db9 commit c31b1aa
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 3 deletions.
6 changes: 6 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.6.3] - Unreleased

### Fixed
- Fix several uses of free on prevously released memory on ESP32, under certain error condition using
`network:start/1`, that would lead to a hard crash of the VM.

## [0.6.2] - 25-05-2024

### Added
Expand Down
7 changes: 4 additions & 3 deletions src/platforms/esp32/components/avm_builtins/network_driver.c
Original file line number Diff line number Diff line change
Expand Up @@ -723,7 +723,6 @@ static void start_network(Context *ctx, term pid, term ref, term config)
if ((err = esp_wifi_set_config(ESP_IF_WIFI_AP, ap_wifi_config)) != ESP_OK) {
ESP_LOGE(TAG, "Error setting AP mode config %d", err);
free(ap_wifi_config);
free(sta_wifi_config);
term error = port_create_error_tuple(ctx, term_from_int(err));
port_send_reply(ctx, pid, ref, error);
return;
Expand All @@ -732,12 +731,14 @@ static void start_network(Context *ctx, term pid, term ref, term config)
free(ap_wifi_config);
}
}

//
// Start the configured interface(s)
//
if ((err = esp_wifi_start()) != ESP_OK) {
ESP_LOGE(TAG, "Error in esp_wifi_start %d", err);
term error = port_create_error_tuple(ctx, term_from_int(err));
port_send_reply(ctx, pid, ref, error);
free(ap_wifi_config);
free(sta_wifi_config);
return;
} else {
ESP_LOGI(TAG, "WIFI started");
Expand Down

0 comments on commit c31b1aa

Please sign in to comment.