Hi Jerome,
On 14.08.26 16:28, Jerome Forissier wrote:
Hi Shahriyar,
On 13/08/2026 18:28, Shahriyar Jalayeri wrote:
wget_do_request() keeps the transfer context on the stack and passes its
address to the lwIP httpc callbacks. If the user interrupts the transfer
with Ctrl-C while the host name is still resolving, wget_handle_request()
leaves its receive loop without tearing the connection down. The pending
DNS lookup (which lwIP cannot cancel) later resolves, the connection is
established, and httpc_recv_cb() runs against a stack frame that no longer
exists. It writes attacker-controlled TCP data through store_block() to
map_sysmem(ctx->daddr), with ctx read from reused stack.
The httpc_connection_t passed to httpc_get_file_dns() has the same lifetime
problem. lwIP stores a pointer to it in httpc_state_t.conn_settings rather
than a copy, and dereferences that pointer later for the result and
headers-done callbacks, so an abandoned request reads its result_fn and
headers_done_fn from a stack frame that is gone.
Allocate the context on the heap, move the connection settings into it
(along with the TLS allocator the settings point at, so nothing lwIP
retains points back at the stack), and add an 'abandoned' flag. On Ctrl-C
with a request still in flight, mark it abandoned and hand ownership to the
lwIP callback, which frees the context when the connection finally tears
down; the receive, headers-done and result callbacks return early so a
stale callback neither stores data nor touches wget_info.
The problem I see is that this relies on a later callback to reclaim the
heap context, but that callback is not guaranteed to run, especially once
the command removes the netif and stops the device. That fixes the UAF by
extending the lifetime, but can turn Ctrl-C into a leak.
I suggest cancelling the in-flight lwIP operation before returning from
wget, while the stack objects are still valid. That likely means adding a
small DNS callback cancellation helper and an httpc_abort() helper, then
calling it on Ctrl-C and freeing the TLS config before returning.
Thanks,
Agreed, the heap can leak on Ctrl-C. I looked at cancelling, and from
what I understand lwIP exposes no way to do it today, So both helpers
are new lwIP API, and since lib/lwip/lwip is a vendored upstream import
I'd like your call, upstream to lwIP first, or add them U-Boot-local?
Thanks,
Shah
