[mdns] handle allocation failure and fix use-after-release (#11854)

This commit changes the `RxMsgEntry` allocation check from `OT_ASSERT`
to `VerifyOrExit`. This ensures that a heap allocation failure for a
multi-packet RX message results in the message being gracefully
dropped, allowing network operation to continue instead of
asserting.

Additionally, `AddNew()` now removes any existing multi-packet message
entries from the same sender before attempting to allocate a new
`RxMsgEntry`. This helps to reclaim resources and prevent stale
entries.

This change also fixes a use-after-release bug by ensuring
that the `aRxMessagePtr` (an `OwnedPtr`) is not accessed after its
ownership is transferred by the `newEntry->Add(aRxMessagePtr)`
call.
This commit is contained in:
Abtin Keshavarzian
2025-08-25 16:09:46 -07:00
committed by GitHub
parent 9deea80b1a
commit 01bce95ba2
+11 -5
View File
@@ -4859,16 +4859,22 @@ exit:
void Core::MultiPacketRxMessages::AddNew(OwnedPtr<RxMessage> &aRxMessagePtr)
{
RxMsgEntry *newEntry = RxMsgEntry::Allocate(GetInstance());
RxMsgEntry *newEntry;
OT_ASSERT(newEntry != nullptr);
newEntry->Add(aRxMessagePtr);
// First remove an existing entries matching same sender
// First remove existing entries matching same sender
// before adding the new entry to the list.
mRxMsgEntries.RemoveMatching(aRxMessagePtr->GetSenderAddress());
newEntry = RxMsgEntry::Allocate(GetInstance());
VerifyOrExit(newEntry != nullptr);
newEntry->Add(aRxMessagePtr);
mRxMsgEntries.Push(*newEntry);
exit:
return;
}
void Core::MultiPacketRxMessages::HandleTimer(void)