fix(rigctl): UAF in RigctlProtocol queued lambdas#2995
Merged
Conversation
G6PWY-Chris
added a commit
to G6PWY-Chris/AetherSDR
that referenced
this pull request
May 23, 2026
RigctlServer::onClientDisconnected() synchronously deletes RigctlProtocol (same pattern as TciServer/TciProtocol fixed in aethersdr#2946). All 16 queued Qt::QueuedConnection lambdas that captured `this` (RigctlProtocol*) are converted to capture `[model = m_model, ...]` by value. RadioModel is owned by MainWindow and outlives every RigctlProtocol, so the queued lambdas no longer depend on the protocol's lifetime. cmdSetPtt also inlines currentSlice() to avoid capturing `this` for the slice lookup, adding the isConnected() guard that the helper had. Closes aethersdr#2990. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
4f9f670 to
f0e4912
Compare
ten9876
added a commit
to pepefrog1234/AetherSDR
that referenced
this pull request
May 23, 2026
…dr#2995 Reconciles three concurrent improvements to cmdSetSplitVfo: - pepefrog1234's edge-detection (m_lastSplitEnable tri-state) so the Hamlib-logger poll doesn't ping-pong TX away from the user's choice - K5PTB's deferred-promotion state (m_pendingSplitEnable / m_pendingTxSlice / m_pendingSplitFreqMHz / m_pendingSplitMode) from aethersdr#2975 - The m_pendingTxSliceChange same-pass race flag from aethersdr#2975 The combined logic: reclaim TX on the RX slice only when we observe a real 1→0 split transition OR the same-pass race (split-1 then split-0 in one onClientData() pass). Steady-state poll-zeros and the first-report-after- connect leave the user's TX badge alone. The race path stays distinct so the queued setTxSlice() race from aethersdr#2975 is still covered. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
9 tasks
G6PWY-Chris
added a commit
to G6PWY-Chris/AetherSDR
that referenced
this pull request
Jun 22, 2026
## Summary - Fixes aethersdr#2990 — `RigctlProtocol` has the same queued-lambda use-after-free pattern fixed for `TciProtocol` in aethersdr#2946 - `RigctlServer::onClientDisconnected()` synchronously `delete`s `RigctlProtocol` while `Qt::QueuedConnection` lambdas capturing `this` may still be queued - All 16 vulnerable `invokeMethod` sites converted from `[this, ...]` to `[model = m_model, ...]` - `cmdSetPtt` inlines `currentSlice()` to avoid capturing `this`, preserving the `isConnected()` guard - `RadioModel` is owned by `MainWindow` and outlives every `RigctlProtocol` — captured `model` pointer is always valid when the lambda fires ## Test plan - [ ] Build passes (CI) - [ ] Rapid rigctl client connect/disconnect cycle does not crash under ASan - [ ] WSJT-X / fldigi rigctld connection still functional (freq/mode/PTT/split) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RigctlProtocolhas the same queued-lambda use-after-free pattern fixed forTciProtocolin fix(tci): use-after-free of TciProtocol in queued lambdas (#2814) #2946RigctlServer::onClientDisconnected()synchronouslydeletesRigctlProtocolwhileQt::QueuedConnectionlambdas capturingthismay still be queuedinvokeMethodsites converted from[this, ...]to[model = m_model, ...]cmdSetPttinlinescurrentSlice()to avoid capturingthis, preserving theisConnected()guardRadioModelis owned byMainWindowand outlives everyRigctlProtocol— capturedmodelpointer is always valid when the lambda firesTest plan
🤖 Generated with Claude Code