Menu

#5 Double free error when coap_send returns COAP_INVALID_TID

closed-fixed
None
5
2012-05-29
2012-05-08
John Sucaet
No

Summary should be clear - Credits to Marc Haesen for revealing this bug
Proposed fix in attachment

Discussion

  • John Sucaet

    John Sucaet - 2012-05-08

    There are more problems with the releasing of the allocated memory by coap_send_impl, particular in resource.c (coap_check_notify). In the attached patch file, I propose to follow a different approach and let the function who allocates, be responsible for releasing the memory.

     
  • Olaf Bergmann

    Olaf Bergmann - 2012-05-10

    coap_check_notify() is indeed broken, thanks for pointing out. I would be interested in your proposal, but your patches have been deleted.

     
  • Olaf Bergmann

    Olaf Bergmann - 2012-05-10
    • assigned_to: nobody --> obgm
    • status: open --> open-accepted
     
  • John Sucaet

    John Sucaet - 2012-05-11
     
  • John Sucaet

    John Sucaet - 2012-05-11

    New patch file added - previous patch files introduced new problems
    Note: only partial tested

     
  • John Sucaet

    John Sucaet - 2012-05-11

    The intent of the current code of coap_send is to release the allocated memory upon success and not to release when an error has occured. However this is broken (returning from coap_send with an error and a deallocated pdu ptr is possible).
    In the patch, I propose to let the calling function (of coap_send) be responsible for free'ing the allocated pointer.

     
  • Olaf Bergmann

    Olaf Bergmann - 2012-05-29

    The patch looks good and is applied in commit 28a6d45cdea2a71cf6fe7b3c211e920ea1a7bf0c. Thanks again to jsucaet and Marc Haesen for fixing this.

     
  • Olaf Bergmann

    Olaf Bergmann - 2012-05-29
    • status: open-accepted --> closed-fixed