[PATCH v2 0/3] net: lwip: fix use-after-free bugs in the wget and dns commands

Three use-after-free bugs in the lwIP wget and dns command glue.

Patch 1 fixes httpc_recv_cb(), which calls altcp_abort() on a store_block()
failure but returns ERR_BUF instead of ERR_ABRT, so tcp_input() keeps using
the freed pcb.

Patch 2 fixes wget, which keeps its transfer context on the stack and hands
its address to the httpc callbacks. Ctrl-C while the host name is still
resolving leaves the connection up, and a later callback runs against the
freed stack frame, writing attacker-controlled data through store_block().
The context, together with the httpc connection settings that lwIP keeps a
pointer to, moves to the heap with an ownership handoff to the lwIP callback.

Patch 3 fixes the same stack-lifetime bug in the dns command, for its
dns_gethostbyname() callback argument.

A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v2:
- Patch 2: also move the httpc connection settings (and the TLS allocator
  they reference) into the heap context. lwIP keeps a pointer to them in
  httpc_state_t.conn_settings and dereferences it from the result and
  headers-done callbacks, so an abandoned request read its callback pointers
  from the freed stack too. (Jerome Forissier)

---
Shahriyar Jalayeri (3):
      net: lwip: wget: return ERR_ABRT after aborting the connection
      net: lwip: wget: free the transfer context after an aborted request
      net: lwip: dns: free the callback context after an aborted lookup

 net/lwip/dns.c  |  38 +++++++++++++++++----
 net/lwip/wget.c | 101 ++++++++++++++++++++++++++++++++++++++++----------------
 2 files changed, 103 insertions(+), 36 deletions(-)
---
base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5
change-id: 20260811-lwip-httpc-uaf-31bf85307bce

Best regards,
--  
Shahriyar Jalayeri <[email protected]>