github/esphome
2
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-10-07 03:16:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

[api] Fix nullptr deref when client teardown reenters state dispatch (#16834)

Browse Source
This commit is contained in:
J. Nick Koston
2026-06-05 10:47:32 -05:00
committed by GitHub
parent cbd3aaa1e0
commit 61bb1805b1
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/api/api_server.cpp
+5 -1
View File
@@ -186,8 +186,12 @@ void APIServer::remove_client_(uint8_t client_index) {
if (client_index < last_index) { if (client_index < last_index) {
std::swap(this->clients_[client_index], this->clients_[last_index]); std::swap(this->clients_[client_index], this->clients_[last_index]);
} }
this->clients_[last_index].reset(); // Drop the count before resetting the slot. reset() runs ~APIConnection(), which can reenter the
// server (e.g. voice_assistant unsubscribes in its disconnect trigger, publishing entity state ->
// on_*_update iterating active_clients()). Excluding the dying slot from the active range first
// keeps that reentrant iteration from dereferencing the now-null slot.
this->api_connection_count_--; this->api_connection_count_--;
this->clients_[last_index].reset();
// Last client disconnected - set warning and start tracking for reboot timeout // Last client disconnected - set warning and start tracking for reboot timeout
if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0) { if (this->api_connection_count_ == 0 && this->reboot_timeout_ != 0) {