obgm/libcoap
2
0 Fork 0
mirror of https://github.com/obgm/libcoap.git synced 2026-11-06 17:52:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #424 from mrdeep1/memory_ref_after_free

Browse Source 
net.c: Fix memory access after session is freed
This commit is contained in:
obgm authored and GitHub committed 2019-12-03 10:32:29 +01:00
2 parents d6c25a9a07 5a2fe9a261
commit e7cacb44fb
1 file changed
+5 -12
Download Patch File Download Diff File Expand all files Collapse all files
src/net.c
+5 -12
View File
@@ -1501,24 +1501,19 @@ coap_io_do_events(coap_context_t *ctx, struct epoll_event *events, size_t nevent
else if (sock->session) {
coap_session_t *session = sock->session;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
if ((sock->flags & COAP_SOCKET_WANT_CONNECT) &&
(events[j].events & (EPOLLOUT|EPOLLERR|EPOLLHUP|EPOLLRDHUP))) {
sock->flags |= COAP_SOCKET_CAN_CONNECT;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_connect_session(session->context, session, now);
coap_session_release(session);
}
if ((sock->flags & COAP_SOCKET_WANT_READ) &&
(events[j].events & (EPOLLIN|EPOLLERR|EPOLLHUP|EPOLLRDHUP))) {
sock->flags |= COAP_SOCKET_CAN_READ;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_read_session(session->context, session, now);
coap_session_release(session);
}
if ((sock->flags & COAP_SOCKET_WANT_WRITE) &&
@@ -1529,12 +1524,10 @@ coap_io_do_events(coap_context_t *ctx, struct epoll_event *events, size_t nevent
*/
coap_epoll_ctl_mod(sock, EPOLLIN, __func__);
sock->flags |= COAP_SOCKET_CAN_WRITE;
/* Make sure the session object is not deleted
in one of the callbacks */
coap_session_reference(session);
coap_write_session(session->context, session, now);
coap_session_release(session);
}
/* Now dereference session so it can go away if needed */
coap_session_release(session);
}
}
else if (ctx->eptimerfd != -1) {