mirror of
https://github.com/esphome/esphome.git
synced 2026-09-16 17:48:40 +00:00
J. Nick Koston
4260ca4b50
Clear LWIP callbacks (tcp_arg, tcp_recv, tcp_err) before calling tcp_close() or tcp_abort() to prevent use-after-free. After tcp_close(), the PCB remains alive during the TCP close handshake (FIN_WAIT, TIME_WAIT states). If LWIP calls recv/err callbacks during this period and the socket object has already been destroyed, the callback writes to freed memory, corrupting the heap. This was observed as umm_malloc_core crashes on ESP8266 during rapid API client connect/disconnect cycles — the heap free-list got corrupted by a dangling callback writing to a freed LWIPRawImpl object. Extract pcb_detach_abort() and pcb_detach_close() helpers to ensure all close/abort sites consistently clear callbacks first.
