Hi Shahriyar, On 19/08/2026 18:56, shj wrote: > Hi Jerome, > > On 14.08.26 16:28, Jerome Forissier wrote: >> Hi Shahriyar, >> >> On 13/08/2026 18:28, Shahriyar Jalayeri wrote: >>> wget_do_request() keeps the transfer context on the stack and passes its >>> address to the lwIP httpc callbacks. If the user interrupts the transfer >>> with Ctrl-C while the host name is still resolving, wget_handle_request() >>> leaves its receive loop without tearing the connection down. The pending >>> DNS lookup (which lwIP cannot cancel) later resolves, the connection is >>> established, and httpc_recv_cb() runs against a stack frame that no longer >>> exists. It writes attacker-controlled TCP data through store_block() to >>> map_sysmem(ctx->daddr), with ctx read from reused stack. >>> >>> The httpc_connection_t passed to httpc_get_file_dns() has the same lifetime >>> problem. lwIP stores a pointer to it in httpc_state_t.conn_settings rather >>> than a copy, and dereferences that pointer later for the result and >>> headers-done callbacks, so an abandoned request reads its result_fn and >>> headers_done_fn from a stack frame that is gone. >>> >>> Allocate the context on the heap, move the connection settings into it >>> (along with the TLS allocator the settings point at, so nothing lwIP >>> retains points back at the stack), and add an 'abandoned' flag. On Ctrl-C >>> with a request still in flight, mark it abandoned and hand ownership to the >>> lwIP callback, which frees the context when the connection finally tears >>> down; the receive, headers-done and result callbacks return early so a >>> stale callback neither stores data nor touches wget_info. >> The problem I see is that this relies on a later callback to reclaim the >> heap context, but that callback is not guaranteed to run, especially once >> the command removes the netif and stops the device. That fixes the UAF by >> extending the lifetime, but can turn Ctrl-C into a leak. >> >> I suggest cancelling the in-flight lwIP operation before returning from >> wget, while the stack objects are still valid. That likely means adding a >> small DNS callback cancellation helper and an httpc_abort() helper, then >> calling it on Ctrl-C and freeing the TLS config before returning. >> >> Thanks, > > > Agreed, the heap can leak on Ctrl-C. I looked at cancelling, and from what I > understand lwIP exposes no way to do it today, So both helpers are new lwIP > API, and since lib/lwip/lwip is a vendored upstream import I'd like your > call, upstream to lwIP first, or add them U-Boot-local?
Well, the former would be ideal, but upstream lwIP is a bit slow at processing pull requests (I’m not blaming anyone here; that’s just how OSS projects work sometimes). So I suggest applying local U-Boot patches and then upstreaming them. If the upstream request changes, we can apply fixups later. Thanks, -- Jerome > > Thanks, > Shah >
