From 744db375a7fa16982d8ffa83f0988b208c9605ab Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Mon, 2 Aug 2021 18:19:21 -0700 Subject: [PATCH] [mesh-forwarder] fix `RemoveDataResponseMessages()` accessing freed msg (#6880) This commit fixes a bug in `RemoveDataResponseMessages()` where `GetNext()` method may be called on an already dequeued and freed `Message` instance (within the `for` loop iteration). The change in this commit ensures to get and retain the `next` message before potentially removing the message from the `mSendQueue` and freeing it. --- src/core/thread/mesh_forwarder_ftd.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/thread/mesh_forwarder_ftd.cpp b/src/core/thread/mesh_forwarder_ftd.cpp index 1a185d4fc..2c817e05a 100644 --- a/src/core/thread/mesh_forwarder_ftd.cpp +++ b/src/core/thread/mesh_forwarder_ftd.cpp @@ -303,9 +303,12 @@ void MeshForwarder::RemoveMessages(Child &aChild, Message::SubType aSubType) void MeshForwarder::RemoveDataResponseMessages(void) { Ip6::Header ip6Header; + Message * next; - for (Message *message = mSendQueue.GetHead(); message; message = message->GetNext()) + for (Message *message = mSendQueue.GetHead(); message != nullptr; message = next) { + next = message->GetNext(); + if (message->GetSubType() != Message::kSubTypeMleDataResponse) { continue;