10864.diff

commit bd1361434619a52b296e6a94c4188aae1a693179
Author: Abtin Keshavarzian <abtink@google.com>
Date:   Tue Oct 9 14:16:30 2018 -0700

    Fix "use after delete" issue in on_mesh_prefix_was_removed() (#359)

diff --git a/src/wpantund/NCPInstanceBase-Addresses.cpp b/src/wpantund/NCPInstanceBase-Addresses.cpp
index cd52e27..bc413c9 100644
--- a/src/wpantund/NCPInstanceBase-Addresses.cpp
+++ b/src/wpantund/NCPInstanceBase-Addresses.cpp
@@ -889,46 +889,46 @@ void
 NCPInstanceBase::on_mesh_prefix_was_removed(Origin origin, const struct in6_addr &prefix_address, uint8_t prefix_len,
 	uint8_t flags, bool stable, uint16_t rloc16, CallbackWithStatus cb)
 {
 	IPv6Prefix prefix(prefix_address, prefix_len);
 	OnMeshPrefixEntry entry(origin, flags, stable, rloc16);
 	std::multimap<IPv6Prefix, OnMeshPrefixEntry>::iterator iter;
 
 	iter = find_prefix_entry(prefix, entry);
 
 	if (iter != mOnMeshPrefixes.end()) {
 		syslog(LOG_INFO, "OnMeshPrefixes: Removing %s", entry.get_description(prefix).c_str());
 		mOnMeshPrefixes.erase(iter);
 
 		if (origin != kOriginThreadNCP) {
 			remove_on_mesh_prefix_on_ncp(prefix.get_prefix(), prefix.get_length(),
 				entry.get_flags(), entry.is_stable(),
 				boost::bind(&NCPInstanceBase::check_ncp_entry_update_status, this, _1, "removing on-mesh prefix", cb));
 		} else {
 			cb(kWPANTUNDStatus_Ok);
 		}
 
 		if (entry.is_on_mesh() && entry.is_slaac() && prefix.get_length() == kSLAACPrefixLength
 			&& !has_slaac_on_mesh_prefix(prefix)
 		) {
 			std::map<struct in6_addr, UnicastAddressEntry>::iterator addr_iter;
 
 			// Note that SLAAC addresses are added with origin NCP.
 			addr_iter = find_address_with_prefix(prefix, kOriginThreadNCP);
 
 			if (addr_iter != mUnicastAddresses.end()) {
-				const struct in6_addr &address = addr_iter->first;
+				struct in6_addr address = addr_iter->first;
 				syslog(LOG_NOTICE, "Removing SLAAC address %s/%d from NCP", in6_addr_to_string(address).c_str(), prefix_len);
 				remove_unicast_address_on_ncp(address, prefix_len,
 					boost::bind(&NCPInstanceBase::check_ncp_entry_update_status, this, _1, "removing SLAAC address", NilReturn()));
 				unicast_address_was_removed(kOriginThreadNCP, address);
 			}
 		}
 	} else {
 		cb(kWPANTUNDStatus_Ok);
 	}
 }
 
 // ========================================================================
 // MARK: Route Management
 
 // Searches for a given route entry in the `mOffMeshRoutes` multimap.