From 974026b5f3358cb2ce71151e05fda636ef2d8f0e Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Mon, 2 Aug 2021 18:26:24 -0700 Subject: [PATCH] [coap] fix `CoapSecure::Stop()` accessing freed message instance (#6883) This commit fixes an issue in `CoapSecure::Stop()` accessing an already dequeued and freed `Message` instance (from the `for` loop iteration trying to `GetNext()` message). The code in this commit removes the head element one by one (`MessageQueue::GetHead()`) until the queue becomes empty. --- src/core/coap/coap_secure.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/core/coap/coap_secure.cpp b/src/core/coap/coap_secure.cpp index 743518d31..c0a23642a 100644 --- a/src/core/coap/coap_secure.cpp +++ b/src/core/coap/coap_secure.cpp @@ -84,9 +84,11 @@ exit: void CoapSecure::Stop(void) { + ot::Message *message; + mDtls.Close(); - for (ot::Message *message = mTransmitQueue.GetHead(); message != nullptr; message = message->GetNext()) + while ((message = mTransmitQueue.GetHead()) != nullptr) { mTransmitQueue.Dequeue(*message); message->Free();