[Fix] Issue-567: Out of Memory crashes in Sub-Ghz

Lechnio · Lechnio · commit 351c63f177be · 2026-07-13T12:18:11.000+02:00
diff --git a/applications/main/subghz/helpers/subghz_txrx.c b/applications/main/subghz/helpers/subghz_txrx.c
@@ -7,6 +7,9 @@
 
 #include <power/power_service/power.h>
 
+#include <furi/core/memmgr.h>
+#include <furi/core/memmgr_heap.h>
+
 #define TAG "SubGhzTxRx"
 
 static void subghz_txrx_radio_device_power_on(SubGhzTxRx* instance) {
@@ -322,6 +325,21 @@ SubGhzTxRxStartTxState subghz_txrx_tx_start(SubGhzTxRx* instance, FlipperFormat*
             FURI_LOG_E(TAG, "Missing Protocol");
             break;
         }
+
+        size_t need_heap = SUBGHZ_TX_MIN_HEAP;
+        size_t need_block = SUBGHZ_TX_MIN_BLOCK;
+        if(furi_string_equal(temp_str, "RAW")) {
+            need_heap = SUBGHZ_TX_MIN_HEAP_RAW;
+            need_block = SUBGHZ_TX_MIN_BLOCK_RAW;
+        }
+        instance->tx_min_heap_required = need_heap;
+        if(memmgr_get_free_heap() < need_heap ||
+           memmgr_heap_get_max_free_block() < need_block) {
+            FURI_LOG_E(TAG, "Not enough memory to start TX");
+            ret = SubGhzTxRxStartTxStateErrorMemory;
+            break;
+        }
+
         ret = SubGhzTxRxStartTxStateOk;
 
         SubGhzRadioPreset* preset = instance->preset;
@@ -416,6 +434,11 @@ FlipperFormat* subghz_txrx_get_fff_data(SubGhzTxRx* instance) {
     return instance->fff_data;
 }
 
+size_t subghz_txrx_get_tx_min_heap_required(SubGhzTxRx* instance) {
+    furi_assert(instance);
+    return instance->tx_min_heap_required;
+}
+
 SubGhzSetting* subghz_txrx_get_setting(SubGhzTxRx* instance) {
     furi_assert(instance);
     return instance->setting;
diff --git a/applications/main/subghz/helpers/subghz_txrx.h b/applications/main/subghz/helpers/subghz_txrx.h
@@ -17,8 +17,18 @@ typedef enum {
     SubGhzTxRxStartTxStateOk,
     SubGhzTxRxStartTxStateErrorOnlyRx,
     SubGhzTxRxStartTxStateErrorParserOthers,
+    SubGhzTxRxStartTxStateErrorMemory,
 } SubGhzTxRxStartTxState;
 
+#define SUBGHZ_TX_MIN_HEAP      (8u * 1024u)
+#define SUBGHZ_TX_MIN_BLOCK     (5u * 1024u)
+#define SUBGHZ_TX_MIN_HEAP_RAW  (14u * 1024u)
+// RAW streaming allocates two large contiguous buffers (stream ~4 KB and the
+// pre-reserved line buffer ~4.6 KB). Require the largest free block to hold both
+#define SUBGHZ_TX_MIN_BLOCK_RAW (9u * 1024u)
+
+size_t subghz_txrx_get_tx_min_heap_required(SubGhzTxRx* instance);
+
 /**
  * Allocate SubGhzTxRx
  * 
diff --git a/applications/main/subghz/helpers/subghz_txrx_i.h b/applications/main/subghz/helpers/subghz_txrx_i.h
@@ -27,5 +27,7 @@ struct SubGhzTxRx {
     SubGhzTxRxNeedSaveCallback need_save_callback;
     void* need_save_context;
 
+    size_t tx_min_heap_required;
+
     bool debug_pin_state;
 };
diff --git a/applications/main/subghz/scenes/subghz_scene_decode_raw.c b/applications/main/subghz/scenes/subghz_scene_decode_raw.c
@@ -1,7 +1,14 @@
 #include "../subghz_i.h"
+#include <furi/core/memmgr.h>
+#include <furi/core/memmgr_heap.h>
 
 #define TAG "SubGhzDecodeRaw"
 
+#define SUBGHZ_DECODE_RAW_MIN_HEAP  (12u * 1024u)
+// The decode worker allocates two large contiguous buffers (stream ~4 KB and the
+// pre-reserved line buffer ~4.6 KB). Require the largest free block to hold both,
+#define SUBGHZ_DECODE_RAW_MIN_BLOCK (9u * 1024u)
+
 #define SAMPLES_TO_READ_PER_TICK 400
 
 static void subghz_scene_receiver_update_statusbar(void* context) {
@@ -145,6 +152,14 @@ bool subghz_scene_decode_raw_start(SubGhz* subghz) {
     } while(false);
 
     if(success) {
+        if(memmgr_get_free_heap() < SUBGHZ_DECODE_RAW_MIN_HEAP ||
+           memmgr_heap_get_max_free_block() < SUBGHZ_DECODE_RAW_MIN_BLOCK) {
+            FURI_LOG_E(TAG, "Not enough memory to decode");
+            subghz->decode_raw_file_worker_encoder = NULL;
+            furi_string_free(file_name);
+            return false;
+        }
+
         //FURI_LOG_I(TAG, "Listening at \033[0;33m%s\033[0m.", furi_string_get_cstr(file_name));
 
         subghz->decode_raw_file_worker_encoder = subghz_file_encoder_worker_alloc();
@@ -160,6 +175,7 @@ bool subghz_scene_decode_raw_start(SubGhz* subghz) {
 
         if(!success) {
             subghz_file_encoder_worker_free(subghz->decode_raw_file_worker_encoder);
+            subghz->decode_raw_file_worker_encoder = NULL;
         }
     }
 
@@ -190,6 +206,14 @@ bool subghz_scene_decode_raw_next(SubGhz* subghz) {
                 subghz->scene_manager, SubGhzSceneDecodeRAW, SubGhzDecodeRawStateLoaded);
             subghz->state_notifications = SubGhzNotificationStateIDLE;
 
+            if(subghz->decode_raw_file_worker_encoder) {
+                if(subghz_file_encoder_worker_is_running(subghz->decode_raw_file_worker_encoder)) {
+                    subghz_file_encoder_worker_stop(subghz->decode_raw_file_worker_encoder);
+                }
+                subghz_file_encoder_worker_free(subghz->decode_raw_file_worker_encoder);
+                subghz->decode_raw_file_worker_encoder = NULL;
+            }
+
             subghz_view_receiver_add_data_progress(subghz->subghz_receiver, "Done!");
             return false; // No more samples available
         }
@@ -269,10 +293,13 @@ bool subghz_scene_decode_raw_on_event(void* context, SceneManagerEvent event) {
 
             subghz_txrx_set_rx_callback(subghz->txrx, NULL, subghz);
 
-            if(subghz_file_encoder_worker_is_running(subghz->decode_raw_file_worker_encoder)) {
-                subghz_file_encoder_worker_stop(subghz->decode_raw_file_worker_encoder);
+            if(subghz->decode_raw_file_worker_encoder) {
+                if(subghz_file_encoder_worker_is_running(subghz->decode_raw_file_worker_encoder)) {
+                    subghz_file_encoder_worker_stop(subghz->decode_raw_file_worker_encoder);
+                }
+                subghz_file_encoder_worker_free(subghz->decode_raw_file_worker_encoder);
+                subghz->decode_raw_file_worker_encoder = NULL;
             }
-            subghz_file_encoder_worker_free(subghz->decode_raw_file_worker_encoder);
 
             subghz->state_notifications = SubGhzNotificationStateIDLE;
             scene_manager_set_scene_state(
diff --git a/applications/main/subghz/scenes/subghz_scene_read_raw.c b/applications/main/subghz/scenes/subghz_scene_read_raw.c
@@ -152,11 +152,20 @@ bool subghz_scene_read_raw_on_event(void* context, SceneManagerEvent event) {
             if((subghz_rx_key_state_get(subghz) == SubGhzRxKeyStateAddKey) ||
                (subghz_rx_key_state_get(subghz) == SubGhzRxKeyStateBack)) {
                 subghz_rx_key_state_set(subghz, SubGhzRxKeyStateExit);
-                if(subghz_scene_read_raw_update_filename(subghz)) {
+                FuriString* temp_raw_path = furi_string_alloc();
+                furi_string_printf(
+                    temp_raw_path,
+                    "%s/%s%s",
+                    SUBGHZ_RAW_FOLDER,
+                    RAW_FILE_NAME,
+                    SUBGHZ_APP_FILENAME_EXTENSION);
+                if(subghz_scene_read_raw_update_filename(subghz) &&
+                   furi_string_equal(subghz->file_path, temp_raw_path)) {
                     furi_string_set(subghz->file_path_tmp, subghz->file_path);
                 } else {
                     furi_string_reset(subghz->file_path_tmp);
                 }
+                furi_string_free(temp_raw_path);
                 scene_manager_next_scene(subghz->scene_manager, SubGhzSceneNeedSaving);
             } else {
                 //Restore default setting
@@ -231,7 +240,10 @@ bool subghz_scene_read_raw_on_event(void* context, SceneManagerEvent event) {
                 //start send
                 subghz->state_notifications = SubGhzNotificationStateIDLE;
                 if(!subghz_tx_start(subghz, subghz_txrx_get_fff_data(subghz->txrx))) {
-                    subghz_rx_key_state_set(subghz, SubGhzRxKeyStateBack);
+                    if(subghz_rx_key_state_get(subghz) != SubGhzRxKeyStateRAWLoad &&
+                       subghz_rx_key_state_get(subghz) != SubGhzRxKeyStateRAWMore) {
+                        subghz_rx_key_state_set(subghz, SubGhzRxKeyStateBack);
+                    }
                     subghz_read_raw_set_status(
                         subghz->subghz_read_raw,
                         SubGhzReadRAWStatusIDLE,
diff --git a/applications/main/subghz/scenes/subghz_scene_transmitter.c b/applications/main/subghz/scenes/subghz_scene_transmitter.c
@@ -129,11 +129,11 @@ bool subghz_scene_transmitter_on_event(void* context, SceneManagerEvent event) {
                     int32_t tmp_counter = furi_hal_subghz_get_rolling_counter_mult();
                     furi_hal_subghz_set_rolling_counter_mult(0);
                     // Calling restore!
-                    subghz_tx_start(subghz, subghz_txrx_get_fff_data(subghz->txrx));
+                    subghz_txrx_tx_start(subghz->txrx, subghz_txrx_get_fff_data(subghz->txrx));
                     subghz_txrx_stop(subghz->txrx);
                     // Calling restore 2nd time special for FAAC SLH!
                     // TODO: Find better way to restore after custom button is used!!!
-                    subghz_tx_start(subghz, subghz_txrx_get_fff_data(subghz->txrx));
+                    subghz_txrx_tx_start(subghz->txrx, subghz_txrx_get_fff_data(subghz->txrx));
                     subghz_txrx_stop(subghz->txrx);
                     furi_hal_subghz_set_rolling_counter_mult(tmp_counter);
                 }
diff --git a/applications/main/subghz/subghz_history.c b/applications/main/subghz/subghz_history.c
@@ -6,7 +6,7 @@
 
 #define SUBGHZ_HISTORY_MAX       65535 // uint16_t index max, ram limit below
 // #define SUBGHZ_HISTORY_FREE_HEAP (23624 * (1 - MIN(rpc_get_sessions_count(instance->rpc), 1U)))
-#define SUBGHZ_HISTORY_FREE_HEAP (4 * 1024)
+#define SUBGHZ_HISTORY_FREE_HEAP (8 * 1024)
 
 #define TAG "SubGhzHistory"
 
diff --git a/applications/main/subghz/subghz_i.c b/applications/main/subghz/subghz_i.c
@@ -3,6 +3,7 @@
 #include "assets_icons.h"
 #include "subghz/types.h"
 #include <furi.h>
+#include <furi/core/memmgr_heap.h>
 #include <notification/notification.h>
 #include <notification/notification_messages.h>
 #include <flipper_format/flipper_format.h>
@@ -33,6 +34,19 @@ bool subghz_tx_start(SubGhz* subghz, FlipperFormat* flipper_format) {
         subghz_dialog_message_freq_error(subghz, can_tx);
         break;
 
+    case SubGhzTxRxStartTxStateErrorMemory: {
+        FuriString* msg = furi_string_alloc();
+        furi_string_printf(
+            msg,
+            "Not enough memory\nFree %u B, block %u B\nNeed %u B",
+            (unsigned)memmgr_get_free_heap(),
+            (unsigned)memmgr_heap_get_max_free_block(),
+            (unsigned)subghz_txrx_get_tx_min_heap_required(subghz->txrx));
+        dialog_message_show_storage_error(subghz->dialogs, furi_string_get_cstr(msg));
+        furi_string_free(msg);
+        break;
+    }
+
     default:
         return true;
         break;
diff --git a/lib/subghz/protocols/keeloq.c b/lib/subghz/protocols/keeloq.c
@@ -121,8 +121,8 @@ void* subghz_protocol_encoder_keeloq_alloc(SubGhzEnvironment* environment) {
     instance->keystore = subghz_environment_get_keystore(environment);
 
     instance->encoder.repeat = 3;
-    instance->encoder.size_upload = 1100;
-    instance->encoder.upload = malloc(instance->encoder.size_upload * sizeof(LevelDuration));
+    instance->encoder.size_upload = 0;
+    instance->encoder.upload = NULL;
     instance->encoder.is_running = false;
 
     instance->manufacture_from_file = furi_string_alloc();
@@ -643,13 +643,17 @@ static bool
     instance->encoder.size_upload = 0;
     size_t upindex = 0;
 
-    // if we change counter/button in SignalSettings menu then we must bypass counter_modes, just gen and save signal file.
     if(subghz_block_generic_global.cnt_need_override ||
        subghz_block_generic_global.btn_need_override)
         bypass = true;
 
-    // Create mode7 upload only if counter and button was not changed by SignalSettings menu
-    if(keeloq_counter_mode == 7 && !bypass) {
+    const bool mode7 = (keeloq_counter_mode == 7 && !bypass);
+    const size_t frame_max = 11 * 2 + 2 + (size_t)instance->generic.data_count_bit * 2 + 2 + 2;
+    const size_t need = frame_max * (mode7 ? 7 : 1);
+    if(instance->encoder.upload) free(instance->encoder.upload);
+    instance->encoder.upload = malloc(need * sizeof(LevelDuration));
+
+    if(mode7) {
         uint16_t temp_cnt = instance->generic.cnt;
         instance->encoder.repeat = 1;
         for(uint8_t i = 7; i > 0; i--) {
@@ -672,6 +676,7 @@ static bool
             upindex = subghz_protocol_encoder_keeloq_encode_to_timings(
                 instance, (uint8_t)0x00, true, upindex);
         }
+        furi_check(upindex <= need);
         instance->encoder.size_upload = upindex;
         return true;
     } else {
@@ -680,6 +685,7 @@ static bool
             subghz_protocol_encoder_keeloq_encode_to_timings(instance, btn, true, upindex);
     }
 
+    furi_check(instance->encoder.size_upload <= need);
     return true;
 }
 
diff --git a/lib/subghz/protocols/raw.c b/lib/subghz/protocols/raw.c
@@ -7,9 +7,13 @@
 
 #include <flipper_format/flipper_format_i.h>
 #include <lib/toolbox/stream/stream.h>
+#include <furi/core/memmgr.h>
+#include <furi/core/memmgr_heap.h>
 
 #define TAG "SubGhzProtocolRaw"
 
+#define SUBGHZ_RAW_TX_MIN_HEAP (7u * 1024u)
+
 #define SUBGHZ_DOWNLOAD_MAX_SIZE 512
 
 static const SubGhzBlockConst subghz_protocol_raw_const = {
@@ -320,6 +324,12 @@ static bool subghz_protocol_encoder_raw_worker_init(SubGhzProtocolEncoderRAW* in
     furi_assert(instance);
     furi_check(!instance->file_worker_encoder);
 
+    if(memmgr_get_free_heap() < SUBGHZ_RAW_TX_MIN_HEAP ||
+       memmgr_heap_get_max_free_block() < SUBGHZ_RAW_TX_MIN_HEAP) {
+        FURI_LOG_E(TAG, "Not enough memory to start TX");
+        return false;
+    }
+
     instance->file_worker_encoder = subghz_file_encoder_worker_alloc();
     if(subghz_file_encoder_worker_start(
            instance->file_worker_encoder,
diff --git a/lib/subghz/subghz_file_encoder_worker.c b/lib/subghz/subghz_file_encoder_worker.c
@@ -10,6 +10,11 @@
 
 #define SUBGHZ_FILE_ENCODER_LOAD 512
 
+// A RAW_Data line holds up to SUBGHZ_DOWNLOAD_MAX_SIZE durations, each up
+// to ~9 chars ("-1000000 "). Reserve the line buffer up front so stream_read_line
+// never has to realloc it while transmitting (realloc traps on OOM on Flipper)
+#define SUBGHZ_FILE_ENCODER_LINE_RESERVE (512u * 9u)
+
 struct SubGhzFileEncoderWorker {
     FuriThread* thread;
     FuriStreamBuffer* stream;
@@ -192,12 +197,13 @@ SubGhzFileEncoderWorker* subghz_file_encoder_worker_alloc(void) {
 
     instance->thread =
         furi_thread_alloc_ex("SubGhzFEWorker", 2048, subghz_file_encoder_worker_thread, instance);
-    instance->stream = furi_stream_buffer_alloc(sizeof(int32_t) * 2048, sizeof(int32_t));
+    instance->stream = furi_stream_buffer_alloc(sizeof(int32_t) * 1024, sizeof(int32_t));
 
     instance->storage = furi_record_open(RECORD_STORAGE);
     instance->flipper_format = flipper_format_file_alloc(instance->storage);
 
     instance->str_data = furi_string_alloc();
+    furi_string_reserve(instance->str_data, SUBGHZ_FILE_ENCODER_LINE_RESERVE);
     instance->file_path = furi_string_alloc();
     instance->worker_stopping = true;
 
diff --git a/lib/subghz/subghz_worker.c b/lib/subghz/subghz_worker.c
@@ -86,7 +86,7 @@ SubGhzWorker* subghz_worker_alloc(void) {
         furi_thread_alloc_ex("SubGhzWorker", 2048, subghz_worker_thread_callback, instance);
 
     instance->stream =
-        furi_stream_buffer_alloc(sizeof(LevelDuration) * 4096, sizeof(LevelDuration));
+        furi_stream_buffer_alloc(sizeof(LevelDuration) * 2048, sizeof(LevelDuration));
 
     //setting default filter in us
     instance->filter_duration = 30;
