From 77292c8415fc3f839b07b8122761ac590a2c0af0 Mon Sep 17 00:00:00 2001 From: Jonathan Bennett Date: Sun, 12 Jul 2026 16:00:24 -0500 Subject: [PATCH] Fid double free in virtual keyboard (#10999) Found via portduino. As there are two separate references to this pointer, they both could call free --- src/graphics/draw/NotificationRenderer.cpp | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/graphics/draw/NotificationRenderer.cpp b/src/graphics/draw/NotificationRenderer.cpp index 8031e31e9..03e53c3bd 100644 --- a/src/graphics/draw/NotificationRenderer.cpp +++ b/src/graphics/draw/NotificationRenderer.cpp @@ -1038,10 +1038,9 @@ void NotificationRenderer::drawTextInput(OLEDDisplay *display, OLEDDisplayUiStat // Cancel virtual keyboard - call callback with empty string to indicate timeout auto callback = textInputCallback; // Store callback before clearing - // Clean up first to prevent re-entry - delete virtualKeyboard; - virtualKeyboard = nullptr; - textInputCallback = nullptr; + // Clean up first to prevent re-entry. The keyboard belongs to OnScreenKeyboardModule; only stop() + // may free it, and it clears virtualKeyboard/textInputCallback for us. + OnScreenKeyboardModule::instance().stop(false); resetBanner(); // Call callback after cleanup @@ -1060,9 +1059,7 @@ void NotificationRenderer::drawTextInput(OLEDDisplay *display, OLEDDisplayUiStat bool handled = OnScreenKeyboardModule::processVirtualKeyboardInput(inEvent, virtualKeyboard); if (!handled && inEvent.inputEvent == INPUT_BROKER_CANCEL) { auto callback = textInputCallback; - delete virtualKeyboard; - virtualKeyboard = nullptr; - textInputCallback = nullptr; + OnScreenKeyboardModule::instance().stop(false); // sole owner of the keyboard; also clears our aliases resetBanner(); if (callback) { callback("");