From fa5766f6427a8f4cfca047c1bd0f10a907caf52b Mon Sep 17 00:00:00 2001 From: jcmichelou Date: Mon, 16 Apr 2018 20:48:23 +0200 Subject: [PATCH] net.c: use after free in coap_free_context() Because of incorrect free order, if there are open TLS connections when coap_free_context() is called a use after free will occur as OpenSSL tries to shutdown the connections. --- src/net.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/net.c b/src/net.c index 9510aca5..d4bde894 100644 --- a/src/net.c +++ b/src/net.c @@ -500,13 +500,13 @@ coap_free_context(coap_context_t *context) { coap_delete_all_resources(context); - if (context->dtls_context) - coap_dtls_free_context(context->dtls_context); - LL_FOREACH_SAFE(context->endpoint, ep, tmp) { coap_free_endpoint(ep); } + if (context->dtls_context) + coap_dtls_free_context(context->dtls_context); + if (context->psk_hint) coap_free(context->psk_hint);