Replace new with malloc for non-class calls (#7868)

* Resolve potential crashes

* Update Esp.cpp

Resolved possible crash in EspClass::getSketchMD5().
This commit is contained in:
David McCurley 2023-12-13 02:22:54 -06:00 committed by GitHub
parent 8d1a84557c
commit 02b384a54a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 29 additions and 25 deletions

View file

@ -225,30 +225,31 @@ String EspClass::getSketchMD5()
const esp_partition_t *running = esp_ota_get_running_partition(); const esp_partition_t *running = esp_ota_get_running_partition();
if (!running) { if (!running) {
log_e("Partition could not be found"); log_e("Partition could not be found");
return String(); return String();
} }
const size_t bufSize = SPI_FLASH_SEC_SIZE; const size_t bufSize = SPI_FLASH_SEC_SIZE;
std::unique_ptr<uint8_t[]> buf(new uint8_t[bufSize]); uint8_t *pb = (uint8_t *)malloc(bufSize);
uint32_t offset = 0; if(!pb) {
if(!buf.get()) {
log_e("Not enough memory to allocate buffer"); log_e("Not enough memory to allocate buffer");
return String(); return String();
} }
uint32_t offset = 0;
MD5Builder md5; MD5Builder md5;
md5.begin(); md5.begin();
while(lengthLeft > 0) { while(lengthLeft > 0) {
size_t readBytes = (lengthLeft < bufSize) ? lengthLeft : bufSize; size_t readBytes = (lengthLeft < bufSize) ? lengthLeft : bufSize;
if (!ESP.flashRead(running->address + offset, reinterpret_cast<uint32_t*>(buf.get()), (readBytes + 3) & ~3)) { if (!ESP.flashRead(running->address + offset, (uint32_t *)pb, (readBytes + 3) & ~3)) {
free(pb);
log_e("Could not read buffer from flash"); log_e("Could not read buffer from flash");
return String(); return String();
} }
md5.add(buf.get(), readBytes); md5.add(pb, readBytes);
lengthLeft -= readBytes; lengthLeft -= readBytes;
offset += readBytes; offset += readBytes;
} }
free(pb);
md5.calculate(); md5.calculate();
result = md5.toString(); result = md5.toString();
return result; return result;

View file

@ -231,7 +231,12 @@ void BLEAdvertising::start() {
int numServices = m_serviceUUIDs.size(); int numServices = m_serviceUUIDs.size();
if (numServices > 0) { if (numServices > 0) {
m_advData.service_uuid_len = 16 * numServices; m_advData.service_uuid_len = 16 * numServices;
m_advData.p_service_uuid = new uint8_t[m_advData.service_uuid_len]; m_advData.p_service_uuid = (uint8_t *)malloc(m_advData.service_uuid_len);
if(!m_advData.p_service_uuid) {
log_e(">> start failed: out of memory");
return;
}
uint8_t* p = m_advData.p_service_uuid; uint8_t* p = m_advData.p_service_uuid;
for (int i = 0; i < numServices; i++) { for (int i = 0; i < numServices; i++) {
log_d("- advertising service: %s", m_serviceUUIDs[i].toString().c_str()); log_d("- advertising service: %s", m_serviceUUIDs[i].toString().c_str());
@ -276,10 +281,8 @@ void BLEAdvertising::start() {
// If we had services to advertise then we previously allocated some storage for them. // If we had services to advertise then we previously allocated some storage for them.
// Here we release that storage. // Here we release that storage.
if (m_advData.service_uuid_len > 0) { free(m_advData.p_service_uuid); //TODO change this variable to local scope?
delete[] m_advData.p_service_uuid;
m_advData.p_service_uuid = nullptr; m_advData.p_service_uuid = nullptr;
}
// Start advertising. // Start advertising.
errRc = ::esp_ble_gap_start_advertising(&m_advParams); errRc = ::esp_ble_gap_start_advertising(&m_advParams);

View file

@ -135,26 +135,26 @@ bool WebServer::authenticate(const char * username, const char * password){
authReq = authReq.substring(6); authReq = authReq.substring(6);
authReq.trim(); authReq.trim();
char toencodeLen = strlen(username)+strlen(password)+1; char toencodeLen = strlen(username)+strlen(password)+1;
char *toencode = new char[toencodeLen + 1]; char *toencode = (char *)malloc[toencodeLen + 1];
if(toencode == NULL){ if(toencode == NULL){
authReq = ""; authReq = "";
return false; return false;
} }
char *encoded = new char[base64_encode_expected_len(toencodeLen)+1]; char *encoded = (char *)malloc(base64_encode_expected_len(toencodeLen)+1);
if(encoded == NULL){ if(encoded == NULL){
authReq = ""; authReq = "";
delete[] toencode; free(toencode);
return false; return false;
} }
sprintf(toencode, "%s:%s", username, password); sprintf(toencode, "%s:%s", username, password);
if(base64_encode_chars(toencode, toencodeLen, encoded) > 0 && authReq.equalsConstantTime(encoded)) { if(base64_encode_chars(toencode, toencodeLen, encoded) > 0 && authReq.equalsConstantTime(encoded)) {
authReq = ""; authReq = "";
delete[] toencode; free(toencode);
delete[] encoded; free(encoded);
return true; return true;
} }
delete[] toencode; free(toencode);
delete[] encoded; free(encoded);;
} else if(authReq.startsWith(F("Digest"))) { } else if(authReq.startsWith(F("Digest"))) {
authReq = authReq.substring(7); authReq = authReq.substring(7);
log_v("%s", authReq.c_str()); log_v("%s", authReq.c_str());

View file

@ -44,11 +44,12 @@ uint8_t WiFiUDP::begin(IPAddress address, uint16_t port){
server_port = port; server_port = port;
tx_buffer = new char[1460]; tx_buffer = (char *)malloc(1460);
if(!tx_buffer){ if(!tx_buffer){
log_e("could not create tx buffer: %d", errno); log_e("could not create tx buffer: %d", errno);
return 0; return 0;
} }
tx_buffer_len = 0;
if ((udp_server=socket(AF_INET, SOCK_DGRAM, 0)) == -1){ if ((udp_server=socket(AF_INET, SOCK_DGRAM, 0)) == -1){
log_e("could not create socket: %d", errno); log_e("could not create socket: %d", errno);
@ -100,7 +101,7 @@ uint8_t WiFiUDP::beginMulticast(IPAddress a, uint16_t p){
void WiFiUDP::stop(){ void WiFiUDP::stop(){
if(tx_buffer){ if(tx_buffer){
delete[] tx_buffer; free(tx_buffer);
tx_buffer = NULL; tx_buffer = NULL;
} }
tx_buffer_len = 0; tx_buffer_len = 0;
@ -136,13 +137,12 @@ int WiFiUDP::beginPacket(){
// allocate tx_buffer if is necessary // allocate tx_buffer if is necessary
if(!tx_buffer){ if(!tx_buffer){
tx_buffer = new char[1460]; tx_buffer = (char *)malloc(1460);
if(!tx_buffer){ if(!tx_buffer){
log_e("could not create tx buffer: %d", errno); log_e("could not create tx buffer: %d", errno);
return 0; return 0;
} }
} }
tx_buffer_len = 0; tx_buffer_len = 0;
// check whereas socket is already open // check whereas socket is already open