Skip to content

ESP8266WebServer - fix possible memory leak in request argument handling #9076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 9, 2024
Merged

ESP8266WebServer - fix possible memory leak in request argument handling #9076

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9fa9930
Fix some minor issues in Parsing-impl.h
everslick Feb 1, 2024
00ffc50
Remove _postArgs member from ESP8266WebServer.h
everslick Feb 5, 2024
5af1ea5
Remove searchiing through always empty _postArgs array in ESP8266WebS…
everslick Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions libraries/ESP8266WebServer/src/ESP8266WebServer-impl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,10 +590,6 @@ const String& ESP8266WebServerTemplate<ServerType>::pathArg(unsigned int i) cons

template <typename ServerType>
const String& ESP8266WebServerTemplate<ServerType>::arg(const String& name) const {
for (int j = 0; j < _postArgsLen; ++j) {
if ( _postArgs[j].key == name )
return _postArgs[j].value;
}
for (int i = 0; i < _currentArgCount + _currentArgsHavePlain; ++i) {
if ( _currentArgs[i].key == name )
return _currentArgs[i].value;
Expand Down Expand Up @@ -622,10 +618,6 @@ int ESP8266WebServerTemplate<ServerType>::args() const {

template <typename ServerType>
bool ESP8266WebServerTemplate<ServerType>::hasArg(const String& name) const {
for (int j = 0; j < _postArgsLen; ++j) {
if (_postArgs[j].key == name)
return true;
}
for (int i = 0; i < _currentArgCount + _currentArgsHavePlain; ++i) {
if (_currentArgs[i].key == name)
return true;
Expand Down
4 changes: 1 addition & 3 deletions libraries/ESP8266WebServer/src/ESP8266WebServer.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,8 +323,6 @@ class ESP8266WebServerTemplate
RequestArgument* _currentArgs = nullptr;
int _currentArgsHavePlain = 0;
std::unique_ptr<HTTPUpload> _currentUpload;
int _postArgsLen = 0;
RequestArgument* _postArgs = nullptr;

int _headerKeysCount = 0;
RequestArgument* _currentHeaders = nullptr;
Expand Down Expand Up @@ -352,4 +350,4 @@ class ESP8266WebServerTemplate
using ESP8266WebServer = esp8266webserver::ESP8266WebServerTemplate<WiFiServer>;
using RequestHandler = esp8266webserver::RequestHandler<WiFiServer>;

#endif //ESP8266WEBSERVER_H
#endif //ESP8266WEBSERVER_H
26 changes: 10 additions & 16 deletions libraries/ESP8266WebServer/src/Parsing-impl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,9 +358,8 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
client.readStringUntil('\n');
//start reading the form
if (line == ("--"+boundary)){
if(_postArgs) delete[] _postArgs;
_postArgs = new RequestArgument[WEBSERVER_MAX_POST_ARGS];
_postArgsLen = 0;
std::unique_ptr<RequestArgument[]> postArgs(new RequestArgument[WEBSERVER_MAX_POST_ARGS]);
int postArgsLen = 0;
while(1){
String argName;
String argValue;
Expand Down Expand Up @@ -408,7 +407,7 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
}
DBGWS("PostArg Value: %s\n\n", argValue.c_str());

RequestArgument& arg = _postArgs[_postArgsLen++];
RequestArgument& arg = postArgs[postArgsLen++];
arg.key = argName;
arg.value = argValue;

Expand Down Expand Up @@ -488,25 +487,20 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
}

int iarg;
int totalArgs = ((WEBSERVER_MAX_POST_ARGS - _postArgsLen) < _currentArgCount)?(WEBSERVER_MAX_POST_ARGS - _postArgsLen):_currentArgCount;
int totalArgs = ((WEBSERVER_MAX_POST_ARGS - postArgsLen) < _currentArgCount)?(WEBSERVER_MAX_POST_ARGS - postArgsLen):_currentArgCount;
for (iarg = 0; iarg < totalArgs; iarg++){
RequestArgument& arg = _postArgs[_postArgsLen++];
RequestArgument& arg = postArgs[postArgsLen++];
arg.key = _currentArgs[iarg].key;
arg.value = _currentArgs[iarg].value;
}
if (_currentArgs) delete[] _currentArgs;
_currentArgs = new RequestArgument[_postArgsLen];
for (iarg = 0; iarg < _postArgsLen; iarg++){
delete[] _currentArgs;
_currentArgs = new RequestArgument[postArgsLen];
for (iarg = 0; iarg < postArgsLen; iarg++){
RequestArgument& arg = _currentArgs[iarg];
arg.key = _postArgs[iarg].key;
arg.value = _postArgs[iarg].value;
arg.key = postArgs[iarg].key;
arg.value = postArgs[iarg].value;
}
_currentArgCount = iarg;
if (_postArgs) {
delete[] _postArgs;
_postArgs = nullptr;
_postArgsLen = 0;
}
return true;
}
DBGWS("Error: line: %s\n", line.c_str());
Expand Down