Heap Overflow in ESP32-audioI2S Library

Executive Summary

This is a heap-based buffer overflow in schreibfaul1 ESP32-audioI2S version 3.4.5. The dismantle_host() function in src/Audio.cpp parses untrusted URL components like host, domain, path, and query without length checks. It copies these segments into fixed-size ps_ptr heap buffers using clone_from(), which can overflow if the input is too large. This leads to memory corruption on ESP32 hardware.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusually long URLs or malformed HTTP requests targeting ESP32-audioI2S devices. Use tools like Wireshark to inspect packet payloads for excessively long host, path, or query parameters. Check system logs for crashes or watchdog reboots on ESP32 devices running version 3.4.5.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by providing a malicious stream URL, causing remote denial of service via ESP32 watchdog reboot. In specific conditions, it might allow arbitrary code execution or leak sensitive heap data. Exploitation is remote and unauthenticated, requiring only a crafted URL.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict network access to ESP32-audioI2S devices until a patch is available. Use firewalls or network segmentation to block untrusted URLs. Monitor device logs for crashes and avoid using vulnerable versions in production environments.

Useful 0 Not Useful 0