github/esphome
2
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-09-16 09:38:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

[socket] Remove invalid tcp_err on listen PCB

Browse Source 
tcp_listen_with_backlog() converts the full tcp_pcb to a smaller
tcp_pcb_listen struct that lacks the errf field. Calling tcp_err()
on a listen PCB writes past the struct boundary, causing memory
corruption and crashes (confirmed on RP2040).

LWIP itself asserts pcb->state != LISTEN in tcp_err().
This commit is contained in:
J. Nick Koston
2026-03-01 08:16:23 -10:00
parent d1b1090f93
commit 3246662a09
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/socket/lwip_raw_tcp_impl.cpp
+3 -1
View File
@@ -616,7 +616,9 @@ int LWIPRawListenImpl::listen(int backlog) {
LWIP_LOG("tcp_arg(%p)", this->pcb_);
tcp_arg(this->pcb_, this);
tcp_accept(this->pcb_, LWIPRawListenImpl::s_accept_fn);
tcp_err(this->pcb_, LWIPRawListenImpl::s_err_fn);
// Note: tcp_err() is NOT re-registered here. tcp_listen_with_backlog() converts the
// full tcp_pcb to a smaller tcp_pcb_listen struct that lacks the errf field.
// Calling tcp_err() on a listen PCB writes past the struct boundary (undefined behavior).
return 0;
}