kevin/meshtastic_firmware
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

Fid double free in virtual keyboard (#10999)

Browse Source 
Found via portduino. As there are two separate references to this pointer, they both could call free
This commit is contained in:
Jonathan Bennett
2026-07-12 16:00:24 -05:00
committed by GitHub
co-authored by GitHub
parent 5513c36757
commit 77292c8415
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/graphics/draw/NotificationRenderer.cpp
+4 -7
View File
@@ -1038,10 +1038,9 @@ void NotificationRenderer::drawTextInput(OLEDDisplay *display, OLEDDisplayUiStat
// Cancel virtual keyboard - call callback with empty string to indicate timeout // Cancel virtual keyboard - call callback with empty string to indicate timeout
auto callback = textInputCallback; // Store callback before clearing auto callback = textInputCallback; // Store callback before clearing
// Clean up first to prevent re-entry // Clean up first to prevent re-entry. The keyboard belongs to OnScreenKeyboardModule; only stop()
delete virtualKeyboard; // may free it, and it clears virtualKeyboard/textInputCallback for us.
virtualKeyboard = nullptr; OnScreenKeyboardModule::instance().stop(false);
textInputCallback = nullptr;
resetBanner(); resetBanner();
// Call callback after cleanup // Call callback after cleanup
@@ -1060,9 +1059,7 @@ void NotificationRenderer::drawTextInput(OLEDDisplay *display, OLEDDisplayUiStat
bool handled = OnScreenKeyboardModule::processVirtualKeyboardInput(inEvent, virtualKeyboard); bool handled = OnScreenKeyboardModule::processVirtualKeyboardInput(inEvent, virtualKeyboard);
if (!handled && inEvent.inputEvent == INPUT_BROKER_CANCEL) { if (!handled && inEvent.inputEvent == INPUT_BROKER_CANCEL) {
auto callback = textInputCallback; auto callback = textInputCallback;
delete virtualKeyboard; OnScreenKeyboardModule::instance().stop(false); // sole owner of the keyboard; also clears our aliases
virtualKeyboard = nullptr;
textInputCallback = nullptr;
resetBanner(); resetBanner();
if (callback) { if (callback) {
callback(""); callback("");