Skip to content

Commit f5ef02d

Browse files
authored
Fix double-free when connecting to WPA2-Enterprise networks (#8529)
* Fix double-free when connecting to WPA2-Enterprise networks Fixes: #8082 This patches the callx0 instruction to a nop in eap.o which is part of libwpa2.a. It looks like espressif fixed the Bug in newer SDK versions, so if we update to the latest NONOS-SDK it is most likely not necessary to add/adapt this patch. Also modifies the fix_sdk_libs.sh script as it even changed files if no changes were necessary, for example adding multiple system_func1 exports. * Apply suggestions from code review
1 parent 502d946 commit f5ef02d

File tree

8 files changed

+40
-9
lines changed

8 files changed

+40
-9
lines changed

Diff for: tools/sdk/lib/NONOSDK221/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK22x_190313/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK22x_190703/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK22x_191024/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK22x_191105/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK22x_191122/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/NONOSDK3V0/libwpa2.a

0 Bytes
Binary file not shown.

Diff for: tools/sdk/lib/fix_sdk_libs.sh

+40-9
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,67 @@
11
#!/bin/bash
22
set -e
33

4-
export PATH=../../xtensa-lx106-elf/bin:$PATH
4+
export PATH=../../../xtensa-lx106-elf/bin:$PATH
55
VERSION=$(basename ${PWD})
66

77
addSymbol_system_func1() {
8-
ADDRESS=$1
9-
xtensa-lx106-elf-objcopy --add-symbol system_func1=.irom0.text:${ADDRESS},function,global user_interface.o
8+
if ! xtensa-lx106-elf-nm user_interface.o | grep -q " T system_func1"; then # Don't add symbol if it already exists
9+
ADDRESS=$1
10+
xtensa-lx106-elf-objcopy --add-symbol system_func1=.irom0.text:${ADDRESS},function,global user_interface.o
11+
fi
1012
}
1113

14+
patchFile() {
15+
FILE=$1
16+
ADDRESS=$2 # DO NOT PASS AS HEX!
17+
LENGTH=$3 # DO NOT PASS AS HEX!
18+
EXPECTED=$4
19+
REPLACEWITH=$5
20+
if [[ "$(dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0)" = "$EXPECTED" ]]; then
21+
echo "Patching $1..."
22+
echo $5 | base64 -d | dd of=$FILE bs=1 count=$LENGTH seek=$ADDRESS conv=notrunc
23+
elif ! [[ "$(dd if=$FILE bs=1 count=$LENGTH skip=$ADDRESS status=none | base64 -w0)" = "$REPLACEWITH" ]]; then
24+
echo "PATCH FAILED!"
25+
exit 0
26+
fi
27+
}
1228

1329
# Remove mem_manager.o from libmain.a to use custom heap implementation,
1430
# and time.o to fix redefinition of time-related functions:
1531
xtensa-lx106-elf-ar d libmain.a mem_manager.o
1632
xtensa-lx106-elf-ar d libmain.a time.o
1733

34+
# Patch WPA2-Enterprise double-free
35+
xtensa-lx106-elf-ar x libwpa2.a eap.o
36+
eapcs=$(sha256sum eap.o | awk '{print $1}')
37+
1838
# Rename `hostname` and `default_hostname` symbols:
1939
xtensa-lx106-elf-ar x libmain.a eagle_lwip_if.o user_interface.o
20-
xtensa-lx106-elf-objcopy --redefine-sym hostname=wifi_station_hostname user_interface.o
21-
xtensa-lx106-elf-objcopy --redefine-sym hostname=wifi_station_hostname eagle_lwip_if.o
22-
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname user_interface.o
23-
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname eagle_lwip_if.o
40+
lwipcs=$(sha256sum eagle_lwip_if.o | awk '{print $1}')
41+
uics=$(sha256sum user_interface.o | awk '{print $1}')
42+
xtensa-lx106-elf-objcopy --redefine-sym hostname=wifi_station_hostname user_interface.o
43+
xtensa-lx106-elf-objcopy --redefine-sym hostname=wifi_station_hostname eagle_lwip_if.o
44+
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname user_interface.o
45+
xtensa-lx106-elf-objcopy --redefine-sym default_hostname=wifi_station_default_hostname eagle_lwip_if.o
2446

2547
if [[ ${VERSION} == "NONOSDK221" ]]; then
2648
addSymbol_system_func1 "0x60"
49+
patchFile "eap.o" "3055" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
2750
elif [[ ${VERSION} == "NONOSDK22x"* ]]; then
2851
addSymbol_system_func1 "0x54"
52+
patchFile "eap.o" "3059" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
2953
elif [[ ${VERSION} == "NONOSDK3"* ]]; then
3054
addSymbol_system_func1 "0x60"
55+
patchFile "eap.o" "3059" "2" "wAA=" "8CA=" # WPA2-Enterprise patch which replaces a double-free with nop, see #8082
3156
else
3257
echo "WARN: Unknown address for system_func1() called by system_restart_local()"
3358
fi
3459

35-
xtensa-lx106-elf-ar r libmain.a eagle_lwip_if.o user_interface.o
36-
rm -f eagle_lwip_if.o user_interface.o
60+
if [[ $(sha256sum eap.o | awk '{print $1}') != $eapcs ]]; then
61+
xtensa-lx106-elf-ar r libwpa2.a eap.o
62+
fi
63+
if [[ $(sha256sum user_interface.o | awk '{print $1}') != $uics || $(sha256sum eagle_lwip_if.o | awk '{print $1}') != $lwipcs ]]; then
64+
xtensa-lx106-elf-ar r libmain.a eagle_lwip_if.o user_interface.o
65+
fi
66+
rm -f eagle_lwip_if.o user_interface.o eap.o
67+

0 commit comments

Comments
 (0)