From d1f065671eab8fcfd25dae8106beedbcc0499452 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Sat, 22 Aug 2026 22:21:04 -0500
Subject: [PATCH] [http_request] Abort OTA backend when update fails before
 first write (#18581)

---
 .../http_request/ota/ota_http_request.cpp       | 17 +++++++++--------
 .../http_request/ota/ota_http_request.h         |  3 +--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/esphome/components/http_request/ota/ota_http_request.cpp b/esphome/components/http_request/ota/ota_http_request.cpp
index 8893b96c65..7e7594c3c3 100644
--- a/esphome/components/http_request/ota/ota_http_request.cpp
+++ b/esphome/components/http_request/ota/ota_http_request.cpp
@@ -64,8 +64,9 @@ void OtaHttpRequestComponent::flash() {
   }
 }
 
-void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container) {
-  if (this->update_started_) {
+void OtaHttpRequestComponent::cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container,
+                                       bool abort_backend) {
+  if (abort_backend) {
     ESP_LOGV(TAG, "Aborting OTA backend");
     backend->abort();
   }
@@ -106,7 +107,8 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   auto error_code = backend->begin(container->content_length);
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "backend->begin error: %d", error_code);
-    this->cleanup_(std::move(backend), container);
+    // Nothing to abort: begin() failed, so no OTA handle was opened
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/false);
     return error_code;
   }
 
@@ -140,7 +142,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       } else {
         ESP_LOGE(TAG, "Error reading data: %d", bufsize_or_error);
       }
-      this->cleanup_(std::move(backend), container);
+      this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
       return OTA_CONNECTION_ERROR;
     }
 
@@ -150,14 +152,13 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
       md5_receive.add(buf, bufsize_or_error);
 
       // write bytes to OTA backend
-      this->update_started_ = true;
       error_code = backend->write(buf, bufsize_or_error);
       if (error_code != ota::OTA_RESPONSE_OK) {
         // error code explanation available at
         // https://github.com/esphome/esphome/blob/dev/esphome/components/ota/ota_backend.h
         ESP_LOGE(TAG, "Error code (%02X) writing binary data to flash at offset %d and size %d", error_code,
                  container->get_bytes_read() - bufsize_or_error, container->content_length);
-        this->cleanup_(std::move(backend), container);
+        this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
         return error_code;
       }
     }
@@ -181,7 +182,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   this->md5_computed_ = md5_receive_str;
   if (strncmp(this->md5_computed_.c_str(), this->md5_expected_.c_str(), MD5_SIZE) != 0) {
     ESP_LOGE(TAG, "MD5 computed: %s - Aborting due to MD5 mismatch", this->md5_computed_.c_str());
-    this->cleanup_(std::move(backend), container);
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
     return ota::OTA_RESPONSE_ERROR_MD5_MISMATCH;
   } else {
     backend->set_update_md5(md5_receive_str);
@@ -197,7 +198,7 @@ uint8_t OtaHttpRequestComponent::do_ota_() {
   error_code = backend->end();
   if (error_code != ota::OTA_RESPONSE_OK) {
     ESP_LOGW(TAG, "Error ending update! error_code: %d", error_code);
-    this->cleanup_(std::move(backend), container);
+    this->cleanup_(std::move(backend), container, /*abort_backend=*/true);
     return error_code;
   }
 
diff --git a/esphome/components/http_request/ota/ota_http_request.h b/esphome/components/http_request/ota/ota_http_request.h
index a706331d9a..9bb748f175 100644
--- a/esphome/components/http_request/ota/ota_http_request.h
+++ b/esphome/components/http_request/ota/ota_http_request.h
@@ -38,7 +38,7 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   void flash();
 
  protected:
-  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container);
+  void cleanup_(ota::OTABackendPtr backend, const std::shared_ptr<HttpContainer> &container, bool abort_backend);
   uint8_t do_ota_();
   std::string get_url_with_auth_(const std::string &url);
   bool http_get_md5_();
@@ -51,7 +51,6 @@ class OtaHttpRequestComponent final : public ota::OTAComponent, public Parented<
   std::string username_{};
   std::string url_{};
   int status_ = -1;
-  bool update_started_ = false;
   static const uint16_t HTTP_RECV_BUFFER = 256;  // the firmware GET chunk size
 };