[PATCH 0/3] net: lwip: fix use-after-free bugs in the wget and dns commands

Three use-after-free bugs in the lwIP wget and dns command glue.

Patch 1 fixes httpc_recv_cb(), which calls altcp_abort() on a store_block()
failure but returns ERR_BUF instead of ERR_ABRT, so tcp_input() keeps using
the freed pcb.

Patch 2 fixes wget, which keeps its transfer context on the stack and hands
its address to the httpc callbacks. Ctrl-C while the host name is still
resolving leaves the connection up, and a later callback runs against the
freed stack frame, writing attacker-controlled data through store_block().
The context moves to the heap with an ownership handoff to the lwIP callback.

Patch 3 fixes the same stack-lifetime bug in the dns command, for its
dns_gethostbyname() callback argument.

A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Shahriyar Jalayeri (3):
      net: lwip: wget: return ERR_ABRT after aborting the connection
      net: lwip: wget: free the transfer context after an aborted request
      net: lwip: dns: free the callback context after an aborted lookup

 net/lwip/dns.c  | 38 ++++++++++++++++++++++------
 net/lwip/wget.c | 77 ++++++++++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 91 insertions(+), 24 deletions(-)
---
base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5
change-id: 20260811-lwip-httpc-uaf-31bf85307bce

Best regards,
--  
Shahriyar Jalayeri <[email protected]>