Skip to content

Fix null dereference in scheduler tick processing - #4571

Merged
cagnulein merged 1 commit into
cagnulein:masterfrom
Qhilm:fix/scheduler-null-deref
Apr 23, 2026
Merged

Fix null dereference in scheduler tick processing#4571
cagnulein merged 1 commit into
cagnulein:masterfrom
Qhilm:fix/scheduler-null-deref

Conversation

@Qhilm

@Qhilm Qhilm commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

Fix null dereference in scheduler path

Problem

In trainprogram.cpp:869, odometer() is called unconditionally:

double odometerFromTheDevice = bluetoothManager->device()->odometer();

This occurs before the null-guard at line 626, creating a TOCTOU race condition:

  1. First, bluetoothManager->device() is accessed (line 869)
  2. Then later, it's checked for null (line 626)
    If the device disconnects between these operations, the code crashes.

Root Cause

Method timeRateFromGPX() calls bluetoothManager->device()->odometer() without checking if device is null (TOCTOU race).

Solution

Add a null guard before the odometer() call to prevent crash under race conditions.
Changes

  • Add preliminary null check in trainprogram.cpp:869 before device access

In trainprogram::scheduler(), bluetoothManager->device()->odometer() is
called unconditionally at line 869. The null guard at line 626 does NOT
protect this call — it enters an if-block that handles the 'not ready'
case (Zwift API, OCR, etc.) but then falls through to line 869 regardless.

If the device disconnects or is null at this point, the code crashes with
a null pointer dereference.

Fix: Add explicit null guard for both bluetoothManager and device() before
the odometer() call. This ensures the scheduler exits safely if the device
is unavailable.
@cagnulein

Copy link
Copy Markdown
Owner

thanks!

@cagnulein
cagnulein merged commit 8b3d744 into cagnulein:master Apr 23, 2026
15 of 17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants