Reset the callbacks and arg (conn) to NULL in do_close_internal(), because

TCP callbacks in api_msg.c can under certain circumstances be called with an
invalid conn pointer after the connection has been closed (and conn has been
freed).

diff --git a/src/api/api_msg.c b/src/api/api_msg.c
index 8c9c24b005f4afff35302cb615c5eb63397ba1d0..27ae91f3b83d32f60cf03e8d8390fe3bbe21e1ae 100644 (file)
--- a/src/api/api_msg.c
+++ b/src/api/api_msg.c
@@ -452,6 +452,12 @@ do_close_internal(struct netconn *conn)
   if (err == ERR_OK) {
     /* Closing succeeded */
     conn->state = NETCONN_NONE;
+    /* Set back some callback pointers as conn is going away */
+    tcp_err(conn->pcb.tcp, NULL);
+    tcp_poll(conn->pcb.tcp, NULL, 4);
+    tcp_sent(conn->pcb.tcp, NULL);
+    tcp_recv(conn->pcb.tcp, NULL);
+    tcp_arg(conn->pcb.tcp, NULL);
     conn->pcb.tcp = NULL;
     conn->err = err;
     /* Trigger select() in socket layer */