mirror of
https://github.com/espressif/esp-idf.git
synced 2026-01-20 21:52:17 +00:00
a5601fbf0d
Add checks to validate client_verify_data pointer and length before processing in handle_session_command1. Prevents NULL pointer dereference when client omits verifier data in Session_Command1, which could cause device crash during provisioning (remote DoS attack). We would like to thank Pavel Kohout from Aisle Research for reporting this vulnerability along with a mitigation strategy.