mirror of
https://github.com/esphome/esphome.git
synced 2026-09-17 10:08:40 +00:00
J. Nick Koston
352150c7f1
Between accept_fn_ storing a raw PCB and accept() picking it up, the connection could error (RST, timeout). Without an error callback, lwip frees the PCB silently, leaving a dangling pointer. When accept() later creates LWIPRawImpl with it, the use-after-free corrupts the heap. Fix: register a lightweight error callback (no allocation) in accept_fn_ that nulls the array slot when the PCB is freed. accept() checks for null and skips freed PCBs. After shifting the array, tcp_arg pointers are updated for remaining entries.
