Skip to content

Commit f5ea352

Browse files
authored
Merge pull request #2 from esp8266/2.7.3
Backports: Correct stack string buffer length. (esp8266#7488) …
2 parents 88ccac3 + 5d3af16 commit f5ea352

File tree

4 files changed

+13
-2
lines changed

4 files changed

+13
-2
lines changed

cores/esp8266/Updater.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ UpdaterClass::UpdaterClass()
3535
, _startAddress(0)
3636
, _currentAddress(0)
3737
, _command(U_FLASH)
38+
, _ledPin(-1)
3839
, _hash(nullptr)
3940
, _verify(nullptr)
4041
, _progress_callback(nullptr)

cores/esp8266/heap.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ void ICACHE_RAM_ATTR print_loc(size_t size, const char* file, int line)
164164
if (inISR && (uint32_t)file >= 0x40200000) {
165165
DEBUG_HEAP_PRINTF("File: %p", file);
166166
} else if (!inISR && (uint32_t)file >= 0x40200000) {
167-
char buf[ets_strlen(file)] __attribute__ ((aligned(4)));
167+
char buf[ets_strlen(file) + 1] __attribute__((aligned(4)));
168168
ets_strcpy(buf, file);
169169
DEBUG_HEAP_PRINTF(buf);
170170
} else {

cores/esp8266/umm_malloc/umm_local.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ int ICACHE_FLASH_ATTR umm_info_safe_printf_P(const char *fmt, ...) {
206206
the PROGMEM address must be word (4 bytes) aligned. The destination
207207
address for ets_memcpy must also be word-aligned.
208208
*/
209-
char ram_buf[ets_strlen(fmt)] __attribute__ ((aligned(4)));
209+
char ram_buf[ets_strlen(fmt) + 1] __attribute__((aligned(4)));
210210
ets_strcpy(ram_buf, fmt);
211211
va_list argPtr;
212212
va_start(argPtr, fmt);

libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp

+10
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,16 @@ void ESP8266WiFiGenericClass::_eventCallback(void* arg)
233233
WiFiClient::stopAll();
234234
}
235235

236+
if (event->event == EVENT_STAMODE_AUTHMODE_CHANGE) {
237+
auto& src = event->event_info.auth_change;
238+
if ((src.old_mode != AUTH_OPEN) && (src.new_mode == AUTH_OPEN)) {
239+
// CVE-2020-12638 workaround. When we get a change to AUTH_OPEN from any other mode, drop the WiFi link because it's a downgrade attack
240+
// TODO - When upgrading to 3.x.x with fix, remove this code
241+
DEBUG_WIFI("WIFI_EVENT_STAMODE_AUTHMODE_CHANGE from encrypted(%d) to AUTH_OPEN, potential downgrade attack. Reconnecting WiFi. See CVE-2020-12638 for more details\n", src.old_mode);
242+
WiFi.reconnect(); // Disconnects from STA and then reconnects
243+
}
244+
}
245+
236246
for(auto it = std::begin(sCbEventList); it != std::end(sCbEventList); ) {
237247
WiFiEventHandler &handler = *it;
238248
if (handler->canExpire() && handler.unique()) {

0 commit comments

Comments
 (0)