From c3bdc5464e2858e37919d9df1f8d98cb3304d3f1 Mon Sep 17 00:00:00 2001
From: "andrey.bychkov" <andrey@signalmodelling.ru>
Date: Mon, 10 Aug 2026 15:48:31 +0300
Subject: [PATCH] fix(piconnection): prevent UAF in DevicePool::run() during
 connection deletion

The background run() thread copies allConnections() then iterates
each connection's diags_ map. If a PIConnection is deleted from
another thread between the copy and the iteration, dereferencing
the pointer is UAF. Add null check and protect diags_ iteration
with __device_pool__ lock.
---
 libs/main/io_utils/piconnection.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libs/main/io_utils/piconnection.cpp b/libs/main/io_utils/piconnection.cpp
index 8b04f33a..afe2c77b 100644
--- a/libs/main/io_utils/piconnection.cpp
+++ b/libs/main/io_utils/piconnection.cpp
@@ -1140,10 +1140,13 @@ PIConnection::DevicePool::DeviceData::~DeviceData() {
 void PIConnection::DevicePool::run() {
 	PIVector<PIConnection *> conns(PIConnection::allConnections());
 	for (PIConnection * c: conns) {
+		if (!c) continue;
+		__device_pool__->lock();
 		for (auto d = c->diags_.begin(); d != c->diags_.end(); d++) {
 			if (!d.value()) continue;
 			d.value()->tick(1);
 		}
+		__device_pool__->unlock();
 	}
 }