From cc2648aef6852dbee3ade164c3c37c18bf03706c Mon Sep 17 00:00:00 2001 From: Jon Shallow Date: Wed, 8 Sep 2021 14:42:56 +0100 Subject: [PATCH] net.c: Protect against session release in coap_io_do_io() Wrap the whole iteration with coap_session_reference() / coap_session_release() instead of the individual if() statements within. coap_io_do_epoll() is already suitably protected. --- src/net.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/src/net.c b/src/net.c index 06f76453..bc935220 100644 --- a/src/net.c +++ b/src/net.c @@ -1753,40 +1753,31 @@ coap_io_do_io(coap_context_t *ctx, coap_tick_t now) { if ((ep->sock.flags & COAP_SOCKET_CAN_ACCEPT) != 0) coap_accept_endpoint(ctx, ep, now); SESSIONS_ITER_SAFE(ep->sessions, s, rtmp) { + /* Make sure the session object is not deleted in one of the callbacks */ + coap_session_reference(s); if ((s->sock.flags & COAP_SOCKET_CAN_READ) != 0) { - /* Make sure the session object is not deleted in one of the callbacks */ - coap_session_reference(s); coap_read_session(ctx, s, now); - coap_session_release(s); } if ((s->sock.flags & COAP_SOCKET_CAN_WRITE) != 0) { - /* Make sure the session object is not deleted in one of the callbacks */ - coap_session_reference(s); coap_write_session(ctx, s, now); - coap_session_release(s); } + coap_session_release(s); } } SESSIONS_ITER_SAFE(ctx->sessions, s, rtmp) { + /* Make sure the session object is not deleted in one of the callbacks */ + coap_session_reference(s); if ((s->sock.flags & COAP_SOCKET_CAN_CONNECT) != 0) { - /* Make sure the session object is not deleted in one of the callbacks */ - coap_session_reference(s); coap_connect_session(ctx, s, now); - coap_session_release( s ); } - if ((s->sock.flags & COAP_SOCKET_CAN_READ) != 0) { - /* Make sure the session object is not deleted in one of the callbacks */ - coap_session_reference(s); + if ((s->sock.flags & COAP_SOCKET_CAN_READ) != 0 && s->ref > 1) { coap_read_session(ctx, s, now); - coap_session_release(s); } - if ((s->sock.flags & COAP_SOCKET_CAN_WRITE) != 0) { - /* Make sure the session object is not deleted in one of the callbacks */ - coap_session_reference(s); + if ((s->sock.flags & COAP_SOCKET_CAN_WRITE) != 0 && s->ref > 1) { coap_write_session(ctx, s, now); - coap_session_release( s ); } + coap_session_release( s ); } #endif /* ! COAP_EPOLL_SUPPORT */ }