From b79a43de30d851e8ac6fa5cc1b4cb3ca5f96f9a4 Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Fri, 26 Jul 2019 10:36:32 +0200 Subject: [PATCH] net.c: Fix use-after-free in coap_cancel() When a subscription is canceled, coap_cancel() iterates through the resources and deletes the observer. In addition, all outstanding messages for this observer are removed from the send queue. With commit 5b1a8f67, the session object associated with the deleted observer may be automatically released by coap_delete_observer(). Therefore, coap_cancel_all_messages() must be invoked on the session before deletion. Fixes CID 1484386 found by Coverity scan. --- src/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/net.c b/src/net.c index d3b25947..4281bc9e 100644 --- a/src/net.c +++ b/src/net.c @@ -1802,8 +1802,8 @@ coap_cancel(coap_context_t *context, const coap_queue_t *sent) { COAP_SET_STR(&token, sent->pdu->token_length, sent->pdu->token); RESOURCES_ITER(context->resources, r) { - num_cancelled += coap_delete_observer(r, sent->session, &token); coap_cancel_all_messages(context, sent->session, token.s, token.length); + num_cancelled += coap_delete_observer(r, sent->session, &token); } return num_cancelled;