Fix double-free in ESP8266WebServer (#4365)

earlephilhower · web-flow · commit bb90e12ea092 · 2018-02-14T07:50:26.000-08:00
In issue #4350, @mongozmaki found that the web server was accessing a deleted variable in the destructor. Implement his suggested change and move the close() before any freeing. Could also have simply NULL'd out the _currentHeaders member after freeing as well. Fixes issue #4350
diff --git a/libraries/ESP8266WebServer/src/ESP8266WebServer.cpp b/libraries/ESP8266WebServer/src/ESP8266WebServer.cpp
@@ -81,6 +81,7 @@ ESP8266WebServer::ESP8266WebServer(int port)
 }
 
 ESP8266WebServer::~ESP8266WebServer() {
+  close();
   if (_currentHeaders)
     delete[]_currentHeaders;
   _headerKeysCount = 0;
@@ -90,7 +91,6 @@ ESP8266WebServer::~ESP8266WebServer() {
     delete handler;
     handler = next;
   }
-  close();
 }
 
 void ESP8266WebServer::begin() {

Original file line number	Diff line number	Diff line change
`@@ -81,6 +81,7 @@ ESP8266WebServer::ESP8266WebServer(int port)`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`ESP8266WebServer::~ESP8266WebServer() {`
	`84`	`+ close();`
`84`	`85`	`if (_currentHeaders)`
`85`	`86`	`delete[]_currentHeaders;`
`86`	`87`	`_headerKeysCount = 0;`
`@@ -90,7 +91,6 @@ ESP8266WebServer::~ESP8266WebServer() {`
`90`	`91`	`delete handler;`
`91`	`92`	`handler = next;`
`92`	`93`	`}`
`93`		`- close();`
`94`	`94`	`}`
`95`	`95`
`96`	`96`	`void ESP8266WebServer::begin() {`