MMS server: fixed memory access problem when client unexpectedly closed connection during file upload (set-file)

src/mms/inc_private/mms_server_internal.h

@@ -361,6 +361,8 @@ mmsServer_handleObtainFileRequest(
         uint32_t invokeId,
         ByteBuffer* response);
 
+void
+mmsServerConnection_stopFileUploadTasks(MmsServerConnection self);
 
 bool
 mmsServer_isIndexAccess(AlternateAccess_t* alternateAccess);

src/mms/iso_mms/server/mms_file_service.c

@@ -588,6 +588,33 @@ mmsServer_fileUploadTask(MmsServer self, MmsObtainFileTask task)
     }
 }
 
+#if (MMS_OBTAIN_FILE_SERVICE == 1)
+
+void
+mmsServerConnection_stopFileUploadTasks(MmsServerConnection self)
+{
+    MmsServer server = self->server;
+
+    int i;
+
+    for (i = 0; i < CONFIG_MMS_SERVER_MAX_GET_FILE_TASKS; i++) {
+
+        if (server->fileUploadTasks[i].state != 0) {
+
+            if (server->fileUploadTasks[i].connection == self) {
+
+
+                /* stop file upload task */
+                FileSystem_closeFile(server->fileUploadTasks[i].fileHandle);
+                deleteFile(MmsServerConnection_getFilesystemBasepath(self), server->fileUploadTasks[i].destinationFilename);
+                server->fileUploadTasks[i].state = 0;
+            }
+
+        }
+    }
+}
+
+#endif /*(MMS_OBTAIN_FILE_SERVICE == 1) */
 void
 mmsServer_handleObtainFileRequest(
         MmsServerConnection connection,

src/mms/iso_mms/server/mms_server_connection.c

@@ -733,6 +733,8 @@ MmsServerConnection_destroy(MmsServerConnection self)
     for (frsmIndex = 0; frsmIndex < CONFIG_MMS_MAX_NUMBER_OF_OPEN_FILES_PER_CONNECTION; frsmIndex++)
         if (self->frsms[frsmIndex].fileHandle != NULL)
             FileSystem_closeFile(self->frsms[frsmIndex].fileHandle);
+
+    mmsServerConnection_stopFileUploadTasks(self);
 #endif
 
 #if (MMS_DYNAMIC_DATA_SETS == 1)