Skip to content

Commit

Permalink
Fix crash in WiFiClient when read() called after stop() (#5197)
Browse files Browse the repository at this point in the history
Thi may happen if read() gets called repeatedly (such as in HttpClient to parse response headers) and the connection is closed unexpectedly or the remote peer may have unexpected behavior that causes the underlying socket to report an error. In that case read() itself calls stop(), which invalidates the receive buffer object. Then when read() is called again without checking, such as inside readStringUntil(), the _rxBuffer is null and ESP32 crashes.
  • Loading branch information
ppescher committed Jun 9, 2021
1 parent fb513c7 commit cb7aef1
Showing 1 changed file with 13 additions and 8 deletions.
21 changes: 13 additions & 8 deletions libraries/WiFi/src/WiFiClient.cpp
Expand Up @@ -442,20 +442,25 @@ size_t WiFiClient::write(Stream &stream)
int WiFiClient::read(uint8_t *buf, size_t size)
{
int res = -1;
res = _rxBuffer->read(buf, size);
if(_rxBuffer->failed()) {
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
stop();
if (_rxBuffer) {
res = _rxBuffer->read(buf, size);
if(_rxBuffer->failed()) {
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
stop();
}
}
return res;
}

int WiFiClient::peek()
{
int res = _rxBuffer->peek();
if(_rxBuffer->failed()) {
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
stop();
int res = -1;
if (_rxBuffer) {
res = _rxBuffer->peek();
if(_rxBuffer->failed()) {
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
stop();
}
}
return res;
}
Expand Down

0 comments on commit cb7aef1

Please sign in to comment.