From 7d193c422f94e0b06a013d45df48b0b3fca3d91f Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Fri, 5 Jan 2018 17:43:51 -0800 Subject: [PATCH] [mesh-forwarder] Clear child's indirect message pointer when removing all its messages (#2456) This commit changes the `ClearChildIndirectMessages(aChild)` method in `MeshForwarder` to ensure that it also clears the indirect message pointer on the child entry. This addresses a subtle bug in the code in the following situation: If we happen to receive a "Child Id Request" from an already valid child for which we are in the middle of an indirect transmission, from `MleRouter::HandleChildIdRequest()` all queued indirect messages for the child are removed (through `MleRouter::RemoveNeighbor()` call). This would then free the indirect message while the child still kept a pointer to the freed message. --- src/core/thread/mesh_forwarder.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/core/thread/mesh_forwarder.cpp b/src/core/thread/mesh_forwarder.cpp index 6eeee7260..7c7ef31ef 100644 --- a/src/core/thread/mesh_forwarder.cpp +++ b/src/core/thread/mesh_forwarder.cpp @@ -211,6 +211,7 @@ void MeshForwarder::ClearChildIndirectMessages(Child &aChild) } } + aChild.SetIndirectMessage(NULL); mSourceMatchController.ResetMessageCount(aChild); exit: