mirror of
https://github.com/espressif/esp-idf.git
synced 2026-04-27 19:13:21 +00:00
Mahavir Jain
d31ef7be16
The command dispatcher routed handlers based solely on msg_type without verifying that the protobuf payload_case field matched. A crafted message with mismatched msg_type and payload_case could cause type confusion, leading to an out-of-bounds read or NULL pointer dereference. Add expected_payload_case to the command table and validate it in the dispatcher before invoking any handler. Please note that this issue was applicable for authenticated clients only (with security1/2 scheme) and hence the impact is on lower side.