Fix a potential segfault when closing a meshlink handle.

Freeing the UTCP instance of a node would result in meshlink_send() being
called on a node that was already partially freed.

diff --git a/src/meshlink.c b/src/meshlink.c
index 4ff26ac16f8847fd3b3ad0522b0d274ef78ec4ce..24d4c249eb8c2285604e2fd9dd5d2f4a51ed8474 100644 (file)
--- a/src/meshlink.c
+++ b/src/meshlink.c
@@ -2396,6 +2396,11 @@ static void channel_accept(struct utcp_connection *utcp_connection, uint16_t por
 
 static ssize_t channel_send(struct utcp *utcp, const void *data, size_t len) {
        node_t *n = utcp->priv;
+
+       if(n->status.destroyed) {
+               return -1;
+       }
+
        meshlink_handle_t *mesh = n->mesh;
        return meshlink_send(mesh, (meshlink_node_t *)n, data, len) ? (ssize_t)len : -1;
 }

diff --git a/src/node.c b/src/node.c
index dec86f885ea1b165619bab76cb17963a1ce4c356..4f4f599932caa1d6985afdc689b1a9d43b670310 100644 (file)
--- a/src/node.c
+++ b/src/node.c
@@ -65,6 +65,8 @@ node_t *new_node(void) {
 void free_node(node_t *n) {
        n->status.destroyed = true;
 
+       utcp_exit(n->utcp);
+
        if(n->edge_tree) {
                free_edge_tree(n->edge_tree);
        }
@@ -80,8 +82,6 @@ void free_node(node_t *n) {
 
        free(n->name);
 
-       utcp_exit(n->utcp);
-
        free(n);
 }