Fixed Free of invalid memory in remote handler

Previously review 476 (75980f86) was submitted as a workaround
for this one, however this fixes the root cause, which is the
options pointer not being set to zero in the condition where there
is no options being set.

Change-Id: I0152dfc8c1813def7762be37fb91cc3cc3f120d3
Signed-off-by: Erich Keane <erich.keane@intel.com>
Reviewed-on: https://gerrit.iotivity.org/gerrit/482
Tested-by: jenkins-iotivity <jenkins-iotivity@opendaylight.org>
Reviewed-by: Sashi Penta <sashi.kumar.penta@intel.com>
Reviewed-by: Ashok Babu Channa <ashok.channa@samsung.com>
Reviewed-by: Sudarshan Prasad <sudarshan.prasad@intel.com>

diff --git a/resource/csdk/connectivity/src/caremotehandler.c b/resource/csdk/connectivity/src/caremotehandler.c
index 76c3428..c3d8d6b 100644 (file)
--- a/resource/csdk/connectivity/src/caremotehandler.c
+++ b/resource/csdk/connectivity/src/caremotehandler.c
@@ -328,6 +328,11 @@ CARequestInfo_t *CACloneRequestInfo(const CARequestInfo_t *rep)
                 rep->info.options,
                 sizeof(CAHeaderOption_t) * rep->info.numOptions);
     }
+    else
+    {
+        clone->info.options = NULL;
+        clone->info.numOptions = 0;
+    }
 
     if (rep->info.payload != NULL)
     {
@@ -406,6 +411,11 @@ CAResponseInfo_t *CACloneResponseInfo(const CAResponseInfo_t *rep)
         memcpy(clone->info.options, rep->info.options,
                 sizeof(CAHeaderOption_t) * rep->info.numOptions);
     }
+    else
+    {
+        clone->info.options = NULL;
+        clone->info.numOptions = 0;
+    }
 
     if (rep->info.payload != NULL)
     {
@@ -451,10 +461,8 @@ void CADestroyRequestInfoInternal(CARequestInfo_t *rep)
     OICFree((char *) rep->info.token);
 
     // free options field
-    if (rep->info.options != NULL && rep->info.numOptions)
-    {
-        OICFree((CAHeaderOption_t *) rep->info.options);
-    }
+    OICFree((CAHeaderOption_t *) rep->info.options);
+
     // free payload field
     OICFree((char *) rep->info.payload);