arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-18 12:24:04 +03:00
Code

ESP8266WebServer - fix possible memory leak in request argument handling (#9076)

Browse Source 
* fix possible leak of _postArgs array in case of returning early from _parseForm().
* don't use _postArgs member, but instead use a new local variable postArgs instead.
* same for _postArgsLen member vs.local postArgsLen.
* remove useless NULL pointer check before delete().
* Remove _postArgs member from ESP8266WebServer.h
* Remove searching through always empty _postArgs array in ESP8266WebServer-impl.h
This commit is contained in:
Clemens Kirchgatterer 2024-02-09 15:28:14 +01:00 committed by GitHub
parent de1029ffe0
commit 16e19181b9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/ESP8266WebServer/src/ESP8266WebServer-impl.h
View File

@ -590,10 +590,6 @@ const String& ESP8266WebServerTemplate<ServerType>::pathArg(unsigned int i) cons
template <typename ServerType>
const String& ESP8266WebServerTemplate<ServerType>::arg(const String& name) const {
for (int j = 0; j < _postArgsLen; ++j) {
if ( _postArgs[j].key == name )
return _postArgs[j].value;
}
for (int i = 0; i < _currentArgCount + _currentArgsHavePlain; ++i) {
if ( _currentArgs[i].key == name )
return _currentArgs[i].value;
@ -622,10 +618,6 @@ int ESP8266WebServerTemplate<ServerType>::args() const {
template <typename ServerType>
bool ESP8266WebServerTemplate<ServerType>::hasArg(const String& name) const {
for (int j = 0; j < _postArgsLen; ++j) {
if (_postArgs[j].key == name)
return true;
}
for (int i = 0; i < _currentArgCount + _currentArgsHavePlain; ++i) {
if (_currentArgs[i].key == name)
return true;

4
libraries/ESP8266WebServer/src/ESP8266WebServer.h
View File

@ -323,8 +323,6 @@ protected:
RequestArgument* _currentArgs = nullptr;
int _currentArgsHavePlain = 0;
std::unique_ptr<HTTPUpload> _currentUpload;
int _postArgsLen = 0;
RequestArgument* _postArgs = nullptr;
int _headerKeysCount = 0;
RequestArgument* _currentHeaders = nullptr;
@ -352,4 +350,4 @@ protected:
using ESP8266WebServer = esp8266webserver::ESP8266WebServerTemplate<WiFiServer>;
using RequestHandler = esp8266webserver::RequestHandler<WiFiServer>;
#endif //ESP8266WEBSERVER_H
#endif //ESP8266WEBSERVER_H

26
libraries/ESP8266WebServer/src/Parsing-impl.h
View File

@ -358,9 +358,8 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
client.readStringUntil('\n');
//start reading the form
if (line == ("--"+boundary)){
if(_postArgs) delete[] _postArgs;
_postArgs = new RequestArgument[WEBSERVER_MAX_POST_ARGS];
_postArgsLen = 0;
std::unique_ptr<RequestArgument[]> postArgs(new RequestArgument[WEBSERVER_MAX_POST_ARGS]);
int postArgsLen = 0;
while(1){
String argName;
String argValue;
@ -408,7 +407,7 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
}
DBGWS("PostArg Value: %s\n\n", argValue.c_str());
RequestArgument& arg = _postArgs[_postArgsLen++];
RequestArgument& arg = postArgs[postArgsLen++];
arg.key = argName;
arg.value = argValue;
@ -488,25 +487,20 @@ bool ESP8266WebServerTemplate<ServerType>::_parseForm(ClientType& client, const
}
int iarg;
int totalArgs = ((WEBSERVER_MAX_POST_ARGS - _postArgsLen) < _currentArgCount)?(WEBSERVER_MAX_POST_ARGS - _postArgsLen):_currentArgCount;
int totalArgs = ((WEBSERVER_MAX_POST_ARGS - postArgsLen) < _currentArgCount)?(WEBSERVER_MAX_POST_ARGS - postArgsLen):_currentArgCount;
for (iarg = 0; iarg < totalArgs; iarg++){
RequestArgument& arg = _postArgs[_postArgsLen++];
RequestArgument& arg = postArgs[postArgsLen++];
arg.key = _currentArgs[iarg].key;
arg.value = _currentArgs[iarg].value;
}
if (_currentArgs) delete[] _currentArgs;
_currentArgs = new RequestArgument[_postArgsLen];
for (iarg = 0; iarg < _postArgsLen; iarg++){
delete[] _currentArgs;
_currentArgs = new RequestArgument[postArgsLen];
for (iarg = 0; iarg < postArgsLen; iarg++){
RequestArgument& arg = _currentArgs[iarg];
arg.key = _postArgs[iarg].key;
arg.value = _postArgs[iarg].value;
arg.key = postArgs[iarg].key;
arg.value = postArgs[iarg].value;
}
_currentArgCount = iarg;
if (_postArgs) {
delete[] _postArgs;
_postArgs = nullptr;
_postArgsLen = 0;
}
return true;
}
DBGWS("Error: line: %s\n", line.c_str());