From 01bce95ba2f191e9dc378a0d71e8fc0bd7d9c9a9 Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Mon, 25 Aug 2025 16:09:46 -0700 Subject: [PATCH] [mdns] handle allocation failure and fix use-after-release (#11854) This commit changes the `RxMsgEntry` allocation check from `OT_ASSERT` to `VerifyOrExit`. This ensures that a heap allocation failure for a multi-packet RX message results in the message being gracefully dropped, allowing network operation to continue instead of asserting. Additionally, `AddNew()` now removes any existing multi-packet message entries from the same sender before attempting to allocate a new `RxMsgEntry`. This helps to reclaim resources and prevent stale entries. This change also fixes a use-after-release bug by ensuring that the `aRxMessagePtr` (an `OwnedPtr`) is not accessed after its ownership is transferred by the `newEntry->Add(aRxMessagePtr)` call. --- src/core/net/mdns.cpp | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/core/net/mdns.cpp b/src/core/net/mdns.cpp index a629d1111..2e1bd8df9 100644 --- a/src/core/net/mdns.cpp +++ b/src/core/net/mdns.cpp @@ -4859,16 +4859,22 @@ exit: void Core::MultiPacketRxMessages::AddNew(OwnedPtr &aRxMessagePtr) { - RxMsgEntry *newEntry = RxMsgEntry::Allocate(GetInstance()); + RxMsgEntry *newEntry; - OT_ASSERT(newEntry != nullptr); - newEntry->Add(aRxMessagePtr); - - // First remove an existing entries matching same sender + // First remove existing entries matching same sender // before adding the new entry to the list. mRxMsgEntries.RemoveMatching(aRxMessagePtr->GetSenderAddress()); + + newEntry = RxMsgEntry::Allocate(GetInstance()); + VerifyOrExit(newEntry != nullptr); + + newEntry->Add(aRxMessagePtr); + mRxMsgEntries.Push(*newEntry); + +exit: + return; } void Core::MultiPacketRxMessages::HandleTimer(void)