From 646a95bf5bfd75d541757da136530b0fbf56adf0 Mon Sep 17 00:00:00 2001 From: Aleksandr Zharov Date: Fri, 23 Oct 2026 02:29:44 +0500 Subject: [PATCH 1/3] [P163] Fix double-free after failed RadSens initialization --- src/src/PluginStructs/P163_data_struct.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/src/PluginStructs/P163_data_struct.cpp b/src/src/PluginStructs/P163_data_struct.cpp index 91e736d15..47fab5444 100644 --- a/src/src/PluginStructs/P163_data_struct.cpp +++ b/src/src/PluginStructs/P163_data_struct.cpp @@ -39,6 +39,7 @@ bool P163_data_struct::init(struct EventStruct *event) { } } else { delete sensor; // Clean up if initialization fails + sensor = nullptr; addLog(LOG_LEVEL_ERROR, F("RadSens: Initialization failed!")); } return isInitialized(); From d1e06e55073cfe1499572ee01d0c5fdc0707447f Mon Sep 17 00:00:00 2001 From: Aleksandr Zharov Date: Fri, 23 Oct 2026 13:52:54 +0500 Subject: [PATCH 2/3] [P163] Check sensor pointer before use isInitialized() now also requires a valid sensor pointer, so plugin_read() and plugin_write() never dereference a null sensor. setOutputValues() checks it as well, and init() deletes a previous sensor object before allocating a new one, so calling it again does not leak. Co-Authored-By: Claude Opus 5.5 --- src/src/PluginStructs/P163_data_struct.cpp | 4 ++++ src/src/PluginStructs/P163_data_struct.h | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/src/PluginStructs/P163_data_struct.cpp b/src/src/PluginStructs/P163_data_struct.cpp index 47fab5444..6d52aa974 100644 --- a/src/src/PluginStructs/P163_data_struct.cpp +++ b/src/src/PluginStructs/P163_data_struct.cpp @@ -25,6 +25,8 @@ P163_data_struct::~P163_data_struct() { * init *****************************************************/ bool P163_data_struct::init(struct EventStruct *event) { + initialized = false; + delete sensor; // In case init() is called again sensor = new (std::nothrow) CG_RadSens(RS_DEFAULT_I2C_ADDRESS); if ((nullptr != sensor) && sensor->init()) { @@ -60,6 +62,8 @@ bool P163_data_struct::plugin_read(struct EventStruct *event) { bool P163_data_struct::setOutputValues(struct EventStruct *event) { bool result = false; + if (nullptr == sensor) { return result; } + const uint32_t count = _readIncrement ? sensor->getNumberOfPulses() : sensor->getNumberOfNewPulses(); const uint32_t incCount = sensor->getNumberOfPulses(); const float iDynamic = sensor->getRadIntensyDynamic(); diff --git a/src/src/PluginStructs/P163_data_struct.h b/src/src/PluginStructs/P163_data_struct.h index a8d0db22e..6ace8694d 100644 --- a/src/src/PluginStructs/P163_data_struct.h +++ b/src/src/PluginStructs/P163_data_struct.h @@ -39,7 +39,7 @@ public: bool plugin_write(struct EventStruct *event, String & string); bool isInitialized() const { - return initialized; + return initialized && (nullptr != sensor); } private: From 3e82efee33326f34114567957bef95735b67e661 Mon Sep 17 00:00:00 2001 From: Aleksandr Zharov Date: Fri, 23 Oct 2026 15:03:31 +0500 Subject: [PATCH 3/3] [P163] Drop the redundant initialized flag sensor is only non-null after a successful init(), so isInitialized() can just check the pointer. Co-Authored-By: Claude Opus 5.5 --- src/src/PluginStructs/P163_data_struct.cpp | 3 --- src/src/PluginStructs/P163_data_struct.h | 4 +--- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/src/src/PluginStructs/P163_data_struct.cpp b/src/src/PluginStructs/P163_data_struct.cpp index 6d52aa974..1173fb23a 100644 --- a/src/src/PluginStructs/P163_data_struct.cpp +++ b/src/src/PluginStructs/P163_data_struct.cpp @@ -25,13 +25,10 @@ P163_data_struct::~P163_data_struct() { * init *****************************************************/ bool P163_data_struct::init(struct EventStruct *event) { - initialized = false; delete sensor; // In case init() is called again sensor = new (std::nothrow) CG_RadSens(RS_DEFAULT_I2C_ADDRESS); if ((nullptr != sensor) && sensor->init()) { - initialized = true; - sensor->setLPmode(_lowPowerMode); sensor->setLedState(_ledState); diff --git a/src/src/PluginStructs/P163_data_struct.h b/src/src/PluginStructs/P163_data_struct.h index 6ace8694d..b79d8ae08 100644 --- a/src/src/PluginStructs/P163_data_struct.h +++ b/src/src/PluginStructs/P163_data_struct.h @@ -39,7 +39,7 @@ public: bool plugin_write(struct EventStruct *event, String & string); bool isInitialized() const { - return initialized && (nullptr != sensor); + return nullptr != sensor; } private: @@ -57,8 +57,6 @@ private: bool _lowPowerMode = false; bool _ledState = true; bool _changeOnly = false; - - bool initialized = false; }; #endif // ifdef USES_P163