Skip to content

Commit cb7aef1

Browse files
authored
Fix crash in WiFiClient when read() called after stop() (#5197)
Thi may happen if read() gets called repeatedly (such as in HttpClient to parse response headers) and the connection is closed unexpectedly or the remote peer may have unexpected behavior that causes the underlying socket to report an error. In that case read() itself calls stop(), which invalidates the receive buffer object. Then when read() is called again without checking, such as inside readStringUntil(), the _rxBuffer is null and ESP32 crashes.
1 parent fb513c7 commit cb7aef1

File tree

1 file changed

+13
-8
lines changed

1 file changed

+13
-8
lines changed

Diff for: libraries/WiFi/src/WiFiClient.cpp

+13-8
Original file line numberDiff line numberDiff line change
@@ -442,20 +442,25 @@ size_t WiFiClient::write(Stream &stream)
442442
int WiFiClient::read(uint8_t *buf, size_t size)
443443
{
444444
int res = -1;
445-
res = _rxBuffer->read(buf, size);
446-
if(_rxBuffer->failed()) {
447-
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
448-
stop();
445+
if (_rxBuffer) {
446+
res = _rxBuffer->read(buf, size);
447+
if(_rxBuffer->failed()) {
448+
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
449+
stop();
450+
}
449451
}
450452
return res;
451453
}
452454

453455
int WiFiClient::peek()
454456
{
455-
int res = _rxBuffer->peek();
456-
if(_rxBuffer->failed()) {
457-
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
458-
stop();
457+
int res = -1;
458+
if (_rxBuffer) {
459+
res = _rxBuffer->peek();
460+
if(_rxBuffer->failed()) {
461+
log_e("fail on fd %d, errno: %d, \"%s\"", fd(), errno, strerror(errno));
462+
stop();
463+
}
459464
}
460465
return res;
461466
}

0 commit comments

Comments
 (0)