Commit caaf9b2b authored by Kishen Maloor's avatar Kishen Maloor

coap:fix invalid read/writes to freed object

Signed-off-by: Kishen Maloor's avatarKishen Maloor <kishen.maloor@intel.com>
parent e0839441
......@@ -76,8 +76,9 @@ oc_blockwise_free_buffer(oc_list_t list, struct oc_memb *pool,
return;
}
if (oc_string_len(buffer->uri_query))
if (oc_string_len(buffer->uri_query) > 0) {
oc_free_string(&buffer->uri_query);
}
oc_free_string(&buffer->href);
oc_list_remove(list, buffer);
#ifdef OC_DYNAMIC_ALLOCATION
......
......@@ -720,12 +720,15 @@ coap_receive(oc_message_t *msg)
* signal from the server. In this case, the client_cb continues
* to live until the response arrives (or it times out).
*/
if (client_cb->separate == 0) {
if (response_buffer) {
response_buffer->ref_count = 0;
if (oc_ri_is_client_cb_valid(client_cb)) {
if (client_cb->separate == 0) {
if (response_buffer) {
response_buffer->ref_count = 0;
}
} else {
client_cb->separate = 0;
}
}
client_cb->separate = 0;
goto send_message;
#else /* OC_BLOCK_WISE */
oc_ri_invoke_client_cb(message, client_cb, &msg->endpoint);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment