* FIX [transport/mqtt] fix UAF in transport, according to upstream

Signed-off-by: jaylin <[email protected]>
emqx · Jul 29, 2024 · efa9c1d · efa9c1d
1 parent c36d5f7
commit efa9c1d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/src/mqtt/transport/tcp/mqtt_tcp.c b/src/mqtt/transport/tcp/mqtt_tcp.c
@@ -580,6 +580,7 @@ mqtt_tcptran_pipe_nego_cb(void *arg)
 		ep->useraio = NULL;
 		nni_aio_finish_error(uaio, rv);
 	}
+	nni_list_remove(&ep->negopipes, p);
 	nni_mtx_unlock(&ep->mtx);
 	mqtt_tcptran_pipe_reap(p);
 }

diff --git a/src/mqtt/transport/tls/mqtt_tls.c b/src/mqtt/transport/tls/mqtt_tls.c
@@ -441,6 +441,7 @@ mqtts_tcptran_pipe_nego_cb(void *arg)
 		ep->useraio = NULL;
 		nni_aio_finish_error(uaio, rv);
 	}
+	nni_list_remove(&ep->negopipes, p);
 	nni_mtx_unlock(&ep->mtx);
 	mqtts_tcptran_pipe_reap(p);
 }