From 3246662a093dae272a895365ef3a581c7f0f98fc Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Sun, 1 Mar 2026 08:16:23 -1000 Subject: [PATCH] [socket] Remove invalid tcp_err on listen PCB tcp_listen_with_backlog() converts the full tcp_pcb to a smaller tcp_pcb_listen struct that lacks the errf field. Calling tcp_err() on a listen PCB writes past the struct boundary, causing memory corruption and crashes (confirmed on RP2040). LWIP itself asserts pcb->state != LISTEN in tcp_err(). --- esphome/components/socket/lwip_raw_tcp_impl.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/esphome/components/socket/lwip_raw_tcp_impl.cpp b/esphome/components/socket/lwip_raw_tcp_impl.cpp index e0e8fec756..f3ac03bedb 100644 --- a/esphome/components/socket/lwip_raw_tcp_impl.cpp +++ b/esphome/components/socket/lwip_raw_tcp_impl.cpp @@ -616,7 +616,9 @@ int LWIPRawListenImpl::listen(int backlog) { LWIP_LOG("tcp_arg(%p)", this->pcb_); tcp_arg(this->pcb_, this); tcp_accept(this->pcb_, LWIPRawListenImpl::s_accept_fn); - tcp_err(this->pcb_, LWIPRawListenImpl::s_err_fn); + // Note: tcp_err() is NOT re-registered here. tcp_listen_with_backlog() converts the + // full tcp_pcb to a smaller tcp_pcb_listen struct that lacks the errf field. + // Calling tcp_err() on a listen PCB writes past the struct boundary (undefined behavior). return 0; }