Fix heap node corruption (esp8266#428)

nowaktechnik · Sep 28, 2015 · 72c9033 · 72c9033
1 parent cef895b
commit 72c9033
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 7 deletions.
diff --git a/hardware/esp8266com/esp8266/cores/esp8266/WString.cpp b/hardware/esp8266com/esp8266/cores/esp8266/WString.cpp
@@ -118,7 +118,7 @@ ICACHE_FLASH_ATTR String::String(double value, unsigned char decimalPlaces) {
 }
 
 ICACHE_FLASH_ATTR String::~String() {
-    os_free(buffer);
+    free(buffer);
 }
 
 // /*********************************************/
@@ -133,7 +133,7 @@ inline void String::init(void) {
 
 void ICACHE_FLASH_ATTR String::invalidate(void) {
     if(buffer)
-        os_free(buffer);
+        free(buffer);
     buffer = NULL;
     capacity = len = 0;
 }
@@ -150,12 +150,18 @@ unsigned char ICACHE_FLASH_ATTR String::reserve(unsigned int size) {
 }
 
 unsigned char ICACHE_FLASH_ATTR String::changeBuffer(unsigned int maxStrLen) {
-    char *newbuffer = (char *) os_realloc(buffer, maxStrLen + 1);
+    size_t newSize = (maxStrLen + 16) & (~0xf);
+    char *newbuffer = (char *) malloc(newSize);
     if(newbuffer) {
+        memset(newbuffer, 0, newSize);
+        memcpy(newbuffer, buffer, len);
+        if (buffer)
+            free(buffer);
+        capacity = newSize - 1;
         buffer = newbuffer;
-        capacity = maxStrLen;
         return 1;
     }
+    buffer = newbuffer;
     return 0;
 }
 
@@ -192,7 +198,7 @@ void ICACHE_FLASH_ATTR String::move(String &rhs) {
             rhs.len = 0;
             return;
         } else {
-            os_free(buffer);
+            free(buffer);
         }
     }
     buffer = rhs.buffer;

diff --git a/hardware/esp8266com/esp8266/libraries/ESP8266WebServer/src/ESP8266WebServer.cpp b/hardware/esp8266com/esp8266/libraries/ESP8266WebServer/src/ESP8266WebServer.cpp
@@ -130,10 +130,10 @@ void ESP8266WebServer::_prepareHeader(String& response, int code, const char* co
 
     sendHeader("Content-Type", content_type, true);
     if (_contentLength != CONTENT_LENGTH_UNKNOWN && _contentLength != CONTENT_LENGTH_NOT_SET) {
-        sendHeader("Content-Length", String(_contentLength).c_str());
+        sendHeader("Content-Length", String(_contentLength));
     }
     else if (contentLength > 0){
-        sendHeader("Content-Length", String(contentLength).c_str());
+        sendHeader("Content-Length", String(contentLength));
     }
     sendHeader("Connection", "close");
     sendHeader("Access-Control-Allow-Origin", "*");

diff --git a/hardware/esp8266com/esp8266/tools/sdk/lib/liblwip.a b/hardware/esp8266com/esp8266/tools/sdk/lib/liblwip.a