Router::handleReceived stores its allocCopy of the encrypted packet in the
class member p_encrypted. callModules() invokes module replies that re-enter
the router via MeshService::sendToMesh -> Router::sendLocal, which on a
broadcast reply recursively calls handleReceived. The inner call overwrites
the outer's p_encrypted without releasing it; on the way out it nulls the
member, the outer release(p_encrypted) now releases nullptr, and the original
allocation is permanently leaked. ~381 B per recursion.
Promote p_encrypted to a function-local so each invocation owns its own copy
for its full lifetime. The MQTT-publish null check at the call site (added by
PR #9136 as a workaround for this bug) stays in place because allocCopy can
still legitimately return nullptr on packetPool exhaustion.
Copilot's review of PR #8999 (the original introduction) flagged this exact
pattern at merge time:
"Storing p_encrypted as a class member can cause issues with recursive or
concurrent calls to handleReceived() since each call would overwrite the
previous packet pointer."
The historical reason for the member (S&F needing to retain the encrypted
copy across calls) was satisfied differently by PR #9799 (ServerAPI converted
to std::unique_ptr + cleanup on connection close), so the member is no longer
load-bearing.
Reproduces issues #9632 / #10101 / #8729 (heap leak when MeshMonitor
connected; TCP drops on Station G2 / LILYGO ServerAPI dump abort).
Hardware A/B on Station G2 under sustained TCP-API retry storm (open :4403,
request config, disconnect mid-stream, repeat at ~0.6/s) - 9 min run:
| Build | heapFree drift | rebootCount delta |
| this patch | -1.5 KB (noise)| 0 |
| stock 2.7.13 | -73 KB (8.1KB/min) | +1 (OOM crash) |
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
I thought git would be smart enough to understand all the whitespace changes but even with all the flags I know to make it ignore theses it still blows up if there are identical changes on both sides.
I have a solution but it require creating a new commit at the merge base for each conflicting PR and merging it into develop.
I don't think blowing up all PRs is worth for now, maybe if we can coordinate this for V3 let's say.
This reverts commit 0d11331d18.
* Add null check for p_encrypted before MQTT publish
A user on BayMesh observed a strange crash in MQTT::onSend that seemed to be a null pointer dereference of this value.
* Trunk
* Calculate hops correctly even when hop_start==0.
* Use the same type (int8_t) in the loop, avoiding signed/unsigned mismatches.
* Clarify defaultIfUnknown is returned for encrypted packets.
* Calculate hops correctly even when hop_start==0.
* Use the same type (int8_t) in the loop, avoiding signed/unsigned mismatches.
* Clarify defaultIfUnknown is returned for encrypted packets.
* RoutingModule::sendAckNak takes ackWantsAck arg to set want_ack on the ACK itself
* Use reliable delivery for traceroute requests (which will be copied to traceroute responses by setReplyTo)
* Update ReliableRouter::sniffReceived to use ReliableRouter::shouldSuccessAckWithWantAck
* Use isFromUs
* Update MockRoutingModule::sendAckNak to include ackWantsAck argument (currently ignored)
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
* feat: implement router hop preservation for router-to-router communication
- Preserve hop_limit when both local device and previous relay are routers/CLIENT_BASE
- Only preserve hops for favorite routers to prevent abuse
- Apply to both FloodingRouter and NextHopRouter
- Update hop counting logic in MeshService for router-to-router communication
This allows routers to communicate over longer distances without
consuming hop limits, improving mesh network efficiency for
infrastructure nodes.
* chore: update protobufs submodule to latest
* Optimized to check friend list first before nodedb.
* Reverting unintended changes
* revert: remove protobufs submodule update
This reverts the protobufs submodule back to a84657c22 to remove
unintended changes from this branch.
* Slight rewrite to remove flawed NO_RELAY_NODE logic and added logic to add isFirstHop. If isFirstHop, always decrease hop_limit to avoid retry logic.
* DRY code. Remove NodeInfo logic that was left over.
* Trunk formatting
* Added compatibility between nodes on different Presets through `Mesh via UDP`
* Optimize multicast handling and channel mapping
- FloodingRouter: remove redundant UDP-encrypted rebroadcast suppression.
- Router: guard multicast fallback with HAS_UDP_MULTICAST and map fallback-decoded packets
to the local default channel via isDefaultChannel()
- UdpMulticastHandler: set transport_mechanism only after successful decode
* trunk fmt
* Move setting transport mechanism.
---------
Co-authored-by: GUVWAF <thijs@havinga.eu>
* Start portduino_config refactor
* refactor GPIOs to new portduino_config
* More portduino_config work
* More conversion to portduino_config
* Finish portduino_config transition
* trunk
* yaml output work
* Simplify the GPIO config
* Trunk
* treewide: make 'ifdef DEBUG_PORT' guards also take into account DEBUG_MUTE
* stm32wl: Add a guard against having debug prints turned on without PIO_FRAMEWORK_ARDUINO_NANOLIB_FLOAT_PRINTF defined
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
* Wipe keys if low entropy
* Client Notification Payload variant
* Don't call service before it's created
* Lucky Number 14
* Catch for low-entropy keys even before region is set
* udp-multicast: remove the thread from the multicast thread API
The whole API is parallel & asynchronous we don't need to start a thread ourself,
the implementation probably does when we call start listening already.
* Take copilot advice and call it a handler
---------
Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
