Merge branch 'bugfix/esp_netif_dangling_hostname' into 'master'

esp_netif: Fixed possible use of hostname pointer after its freed

Closes IDFGH-4189

See merge request espressif/esp-idf!11085

components/esp_netif/lwip/esp_netif_lwip.c

@@ -1133,19 +1133,20 @@ static esp_err_t esp_netif_set_hostname_api(esp_netif_api_msg_t *msg)
 #if LWIP_NETIF_HOSTNAME
 
     struct netif *p_netif = esp_netif->lwip_netif;
-    if (esp_netif->hostname) {
-        free(esp_netif->hostname);
-    }
-    esp_netif->hostname = strdup(hostname);
-    if (esp_netif->hostname == NULL) {
-        return ESP_ERR_NO_MEM;
-    }
 
     if (strlen(hostname) > ESP_NETIF_HOSTNAME_MAX_SIZE) {
         return ESP_ERR_ESP_NETIF_INVALID_PARAMS;
     }
 
     if (p_netif != NULL) {
+        if (esp_netif->hostname) {
+            free(esp_netif->hostname);
+        }
+        esp_netif->hostname = strdup(hostname);
+        if (esp_netif->hostname == NULL) {
+            p_netif->hostname = CONFIG_LWIP_LOCAL_HOSTNAME;
+            return ESP_ERR_NO_MEM;
+        }
         p_netif->hostname = esp_netif->hostname;
         return ESP_OK;
     } else {

components/esp_netif/test/test_esp_netif.c

@@ -275,5 +275,13 @@ TEST_CASE("esp_netif: get/set hostname", "[esp_netif]")
     TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_hostname(esp_netif, &hostname));
     TEST_ASSERT_EQUAL_STRING(hostname, "new_name");
 
+    // test that setting the long name is refused and the previously set value retained
+    #define ESP_NETIF_HOSTNAME_MAX_SIZE    32
+    char long_name[ESP_NETIF_HOSTNAME_MAX_SIZE + 2] = { 0 };
+    memset(long_name, 'A', ESP_NETIF_HOSTNAME_MAX_SIZE+1); // construct the long name
+    TEST_ASSERT_NOT_EQUAL(ESP_OK, esp_netif_set_hostname(esp_netif, long_name));
+    TEST_ASSERT_EQUAL(ESP_OK, esp_netif_get_hostname(esp_netif, &hostname));
+    TEST_ASSERT_EQUAL_STRING(hostname, "new_name");
+
     esp_netif_destroy(esp_netif);
 }