tools/mesh-cfgclient: Fix errors found by static analysis

This fixes a NULL pointer dereference error in subscription_cmd().

Also re-order calling sequence for l_free() & l_queue_remove()
in msg_recvd(): even though technically it is not a bug to pass
a value of a freed pointer to l_queue_remove(), it's a poor form
and confuses the analyzer.

Change-Id: I6863f60c23dbda3e2030bee7d8d7c8fe666887de
Signed-off-by: anuj.bhumiya <anuj.bhumiya@samsung.com>

diff --git a/tools/mesh/cfgcli.c b/tools/mesh/cfgcli.c
index 292bb7e..aefd72a 100644 (file)
--- a/tools/mesh/cfgcli.c
+++ b/tools/mesh/cfgcli.c
@@ -420,8 +420,8 @@ static bool msg_recvd(uint16_t src, uint16_t idx, uint8_t *data,
        req = get_req_by_rsp(src, opcode);
        if (req) {
                cmd = req->cmd;
-               free_request(req);
                l_queue_remove(requests, req);
+               free_request(req);
        } else
                cmd = NULL;
 
@@ -1480,15 +1480,14 @@ static void subscription_cmd(int argc, char *argv[], uint32_t opcode)
 
        grp = l_queue_find(groups, match_group_addr, L_UINT_TO_PTR(sub_addr));
 
-       if (!grp && opcode != OP_CONFIG_MODEL_SUB_DELETE) {
-               grp = add_group(sub_addr);
-
-               if (!grp && IS_VIRTUAL(sub_addr)) {
-                       print_virtual_not_found(sub_addr);
-                       return bt_shell_noninteractive_quit(EXIT_FAILURE);
-               }
+       if (!grp && IS_VIRTUAL(sub_addr)) {
+               print_virtual_not_found(sub_addr);
+               return bt_shell_noninteractive_quit(EXIT_FAILURE);
        }
 
+       if (!grp && opcode != OP_CONFIG_MODEL_SUB_DELETE)
+               grp = add_group(sub_addr);
+
        if (IS_VIRTUAL(sub_addr)) {
                if (opcode == OP_CONFIG_MODEL_SUB_ADD)
                        opcode = OP_CONFIG_MODEL_SUB_VIRT_ADD;