arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-08-18 17:42:23 +03:00
Code Activity

Fix memory related issues w/BearSSL server/client (#5706)

Browse Source 
Because the constructors of the BSSL client and server add a reference
count to the stack_thunk, if there is no copy constructor defined then
the stack thunk reference count can get out of sync causing the stack
thunk memory to be freed while still in use.  That could cause random
crashes or hangs.

Add a very basic copy constructor to the WiFiClientSecure and
WiFiServerSecure objects, using the default operator= to duplicate
simple types and shared_ptr classes.

The _cipher_list element (used only w/custom ciphers) could be freed
while still in use if copies of the WiFiClientSecure object were made.

Use a shared_ptr which will only free when the last reference is
deleted.

The axTLS compatibility mode calls allocate and store elements needed
for SSL connections (unlike normal BearSSL calls).  These elements could
be freed mistakenly while still in use if copies of the WiFiClientSecure
were made by the app.

Convert to a separately managed shared_ptr to ensure they live as long
as any referencing objects before deletion.

Same done for the axTLS compatability for WiFiServerSecure.
This commit is contained in:
Earle F. Philhower, III
2019-02-02 18:09:19 +00:00
committed by GitHub
parent 1cacf92ce1
commit 56268b166d
4 changed files with 63 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.h
View File

@@ -34,6 +34,7 @@ namespace BearSSL {
class WiFiClientSecure : public WiFiClient {
public:
WiFiClientSecure();
WiFiClientSecure(const WiFiClientSecure &rhs);
~WiFiClientSecure() override;
int connect(CONST IPAddress& ip, uint16_t port) override;
@@ -206,6 +207,14 @@ class WiFiClientSecure : public WiFiClient {
bool _handshake_done;
bool _oom_err;
// AXTLS compatibility shim elements:
// AXTLS managed memory for certs and keys, while BearSSL assumes
// the app manages these. Use this local storage for holding the
// BearSSL created objects in a shared form.
std::shared_ptr<X509List> _axtls_ta;
std::shared_ptr<X509List> _axtls_chain;
std::shared_ptr<PrivateKey> _axtls_sk;
// Optional storage space pointer for session parameters
// Will be used on connect and updated on close
Session *_session;
@@ -218,7 +227,7 @@ class WiFiClientSecure : public WiFiClient {
unsigned _knownkey_usages;
// Custom cipher list pointer or NULL if default
uint16_t *_cipher_list;
std::shared_ptr<uint16_t> _cipher_list;
uint8_t _cipher_cnt;
unsigned char *_recvapp_buf;
@@ -255,9 +264,6 @@ class WiFiClientSecure : public WiFiClient {
bool _installServerX509Validator(const X509List *client_CA_ta); // Setup X509 client cert validation, if supplied
uint8_t *_streamLoad(Stream& stream, size_t size);
// AXTLS compatible mode needs to delete the stored certs and keys on destruction
bool _deleteChainKeyTA;
};
};