- fixed double free in IedConnection_destroy when control object clients have not been deleted before (LIB61850-503)

examples/iec61850_client_example_async/client_example_async.c

@@ -308,6 +308,7 @@ int main(int argc, char** argv)
                     printf("Failed to send operate %i\n", error);
                 }
 
+                MmsValue_delete(ctlVal);
             }
             else
             {

src/iec61850/client/ied_connection.c

@@ -963,6 +963,25 @@ IedConnection_close(IedConnection self)
     }
 }
 
+static void
+deleteControlObjectClients(IedConnection self)
+{
+    while (LinkedList_size(self->clientControls) > 0)
+    {
+        LinkedList elem = LinkedList_getNext(self->clientControls);
+
+        if (elem)
+        {
+            ControlObjectClient coClient = (ControlObjectClient)LinkedList_getData(elem);
+
+            if (coClient)
+            {
+                ControlObjectClient_destroy(coClient);
+            }
+        }
+    }
+}
+
 void
 IedConnection_destroy(IedConnection self)
 {
@@ -978,7 +997,9 @@ IedConnection_destroy(IedConnection self)
 
     GLOBAL_FREEMEM(self->outstandingCalls);
 
-    LinkedList_destroyDeep(self->clientControls, (LinkedListValueDeleteFunction)ControlObjectClient_destroy);
+    deleteControlObjectClients(self);
+
+    LinkedList_destroyStatic(self->clientControls);
 
     Semaphore_destroy(self->clientControlsLock);
     Semaphore_destroy(self->outstandingCallsLock);

src/iec61850/inc/iec61850_client.h

@@ -2130,6 +2130,9 @@ ControlObjectClient_createEx(const char* objectReference, IedConnection connecti
 /**
  * \brief Destroy the client control object instance and release all related resources
  *
+ * NOTE: Can only be called before calling IedConnection_destroy! When calling IedConnection_destroy this
+ * function will be called automatically.
+ *
  * \param self the control object instance to use
  */
 LIB61850_API void