Null-check reply allocations in allocErrorResponse and RemoteHardware - #11260
Conversation
allocAckNak returns nullptr when the packet pool is exhausted, but allocErrorResponse passed the result straight to setReplyTo, which dereferences it. Reachable unauthenticated: an ADMIN_APP packet on a known-key channel takes the NOT_AUTHORIZED path, so a flood that empties the pool crashes the node. MemoryDynamic::alloc no longer aborting on failure made this reachable on PSRAM, STM32WL and Portduino targets. Callers already treat a null reply as no response. Same fix for the two RemoteHardwareModule sites.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe changes add null checks around packet allocation in mesh error responses and remote hardware GPIO reply and broadcast paths. ChangesPacket allocation failure handling
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
⚡ Try this PR in the Web FlasherWarning This is an automated, unreviewed CI test build. Back up your device configuration Supported boards built by this PR (31)
Build artifacts expire on 2026-08-26. Updated for |
allocAckNak returns nullptr when the packet pool is exhausted (#11086), but allocErrorResponse passes the result straight to setReplyTo, which dereferences it. The assert there is compiled out in release builds, so it proceeds to a null store.
Reachable unauthenticated: AdminModule has no bound channel, so an ADMIN_APP packet on a channel whose key the sender has takes the NOT_AUTHORIZED path at AdminModule.cpp:227. Flooding to exhaust the pool then crashes the node. #11197 (MemoryDynamic::alloc no longer asserting on failure) made this reachable on PSRAM, STM32WL and Portduino targets, where it previously aborted instead.
Every consumer of the reply already null-checks, so returning nullptr degrades to no response. The two RemoteHardwareModule sites have the same unchecked pattern and are fixed alongside.
Summary by CodeRabbit