Use-after-free in AsyncWebServerRequest::_removeNotInterestingHeaders #951
Description
Hi,
While running my code with Valgrind in an effort to troubleshoot memory-corruption issues I noticed there's a use-after-free error in this library's code.
Here the function iterates over a linked list of headers, and removes not-interesting ones from the list.
https://github.com/me-no-dev/ESPAsyncWebServer/blob/master/src/WebRequest.cpp#L183-L186
Here, the linked list's remove method correctly updates the next pointer and frees the removed item:
https://github.com/me-no-dev/ESPAsyncWebServer/blob/master/src/StringArray.h#L120-L132
However, if an item is deleted during iteration, the iterator still holds a reference to its memory, and it still uses it to retrieve the next pointer:
https://github.com/me-no-dev/ESPAsyncWebServer/blob/master/src/StringArray.h#L53
While this works in most cases and particularly on the ESP MCUs, on my testing setup I get a nice SIGSEGV.
A potential fix could be retrieving the next pointer ahead of time and storing it in the iterator. Then in operator++ replace it with the "next-next" pointer and return the stored next pointer. This should make deleting the current item safe.
(If you're wondering how the hell I'm running it with valgrind, I stubbed all the Arduino calls and patched ESPAsyncTCP to use the POSIX socket API, and I'm running my application as a regular Linux program)