This fixes a NULL pointer dereference error in subscription_cmd().
Also re-order calling sequence for l_free() & l_queue_remove()
in msg_recvd(): even though technically it is not a bug to pass
a value of a freed pointer to l_queue_remove(), it's a poor form
and confuses the analyzer.
---
tools/mesh/cfgcli.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/tools/mesh/cfgcli.c b/tools/mesh/cfgcli.c
index 1c20db85a..d8eee4edc 100644
--- a/tools/mesh/cfgcli.c
+++ b/tools/mesh/cfgcli.c
@@ -410,8 +410,8 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data,
req = get_req_by_rsp(src, opcode);
if (req) {
cmd = req->cmd;
- free_request(req);
l_queue_remove(requests, req);
+ free_request(req);
} else
cmd = NULL;
@@ -1470,15 +1470,14 @@ static void subscription_cmd(int argc, char *argv[], uint32_t opcode)
grp = l_queue_find(groups, match_group_addr, L_UINT_TO_PTR(sub_addr));
- if (!grp && opcode != OP_CONFIG_MODEL_SUB_DELETE) {
- grp = add_group(sub_addr);
-
- if (!grp && IS_VIRTUAL(sub_addr)) {
- print_virtual_not_found(sub_addr);
- return bt_shell_noninteractive_quit(EXIT_FAILURE);
- }
+ if (!grp && IS_VIRTUAL(sub_addr)) {
+ print_virtual_not_found(sub_addr);
+ return bt_shell_noninteractive_quit(EXIT_FAILURE);
}
+ if (!grp && opcode != OP_CONFIG_MODEL_SUB_DELETE)
+ grp = add_group(sub_addr);
+
if (IS_VIRTUAL(sub_addr)) {
if (opcode == OP_CONFIG_MODEL_SUB_ADD)
opcode = OP_CONFIG_MODEL_SUB_VIRT_ADD;
--
2.26.2
