Three use-after-free bugs in the lwIP wget and dns command glue. Patch 1 fixes httpc_recv_cb(), which calls altcp_abort() on a store_block() failure but returns ERR_BUF instead of ERR_ABRT, so tcp_input() keeps using the freed pcb.
Patch 2 fixes wget, which keeps its transfer context on the stack and hands its address to the httpc callbacks. Ctrl-C while the host name is still resolving leaves the connection up, and a later callback runs against the freed stack frame, writing attacker-controlled data through store_block(). The context moves to the heap with an ownership handoff to the lwIP callback. Patch 3 fixes the same stack-lifetime bug in the dns command, for its dns_gethostbyname() callback argument. A reproducer is available on request. Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Shahriyar Jalayeri (3): net: lwip: wget: return ERR_ABRT after aborting the connection net: lwip: wget: free the transfer context after an aborted request net: lwip: dns: free the callback context after an aborted lookup net/lwip/dns.c | 38 ++++++++++++++++++++++------ net/lwip/wget.c | 77 ++++++++++++++++++++++++++++++++++++++++++++------------- 2 files changed, 91 insertions(+), 24 deletions(-) --- base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5 change-id: 20260811-lwip-httpc-uaf-31bf85307bce Best regards, -- Shahriyar Jalayeri <[email protected]>
