mirror of
https://github.com/obgm/libcoap.git
synced 2026-10-27 05:01:23 +03:00
coap_notify_observers() walked the subscribers with LL_FOREACH_SAFE(), which holds on to the next subscription while the current one is notified. The request handler runs with the lock released, and a notification that cannot be sent disconnects the session, which deletes all of that session's subscriptions. When the next subscription was one of those, the walk carried on with freed memory. Mark the subscriptions to visit at the start of the walk and look up the next marked one from the head of the list after each notification, so nothing deleted during a notification is used afterwards. Subscriptions added during the walk are not notified in that pass, as before. Add a unit test.