From bed86cddb3ca1eb7639583d724acfce5e9279a73 Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Fri, 13 Nov 2015 11:48:18 -0200
Subject: [PATCH 1/4] Fixed uninitialized memory usage in packet sending.

---
 src/peer.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/peer.c b/src/peer.c
index 456049a..61da260 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -610,8 +610,10 @@ rudp_error_t rudp_peer_send_connect(struct rudp_peer *peer)
 {
     struct rudp_packet_chain *pc = rudp_packet_chain_alloc(
         peer->rudp, sizeof(struct rudp_packet_conn_req));
+    struct rudp_packet_conn_req *conn_req = &pc->packet->conn_req;
 
-    pc->packet->header.command = RUDP_CMD_CONN_REQ;
+    conn_req->header.command = RUDP_CMD_CONN_REQ;
+    conn_req->data = 0;
 
     peer->state = PEER_CONNECTING;
 
@@ -652,6 +654,8 @@ static void peer_send_queue(struct rudp_peer *peer)
             header->opt |= RUDP_OPT_ACK;
             header->reliable_ack = htons(peer->in_seq_reliable);
 //            peer->must_ack = 0;
+        } else {
+            header->reliable_ack = 0;
         }
 
         rudp_log_printf(peer->rudp, RUDP_LOG_IO,

From 5228795183fcc33aa78bc7915530677e4e6f92eb Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Fri, 13 Nov 2015 14:57:20 -0200
Subject: [PATCH 2/4] Fixed a memory leak.

---
 src/client.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/client.c b/src/client.c
index f8a8a50..09cc56c 100644
--- a/src/client.c
+++ b/src/client.c
@@ -70,6 +70,7 @@ rudp_error_t rudp_client_close(struct rudp_client *client)
 
 rudp_error_t rudp_client_deinit(struct rudp_client *client)
 {
+    rudp_address_deinit(&client->address);
     rudp_endpoint_deinit(&client->endpoint);
     return 0;
 }

From 83eb9e6ab659c2b868b12d42bdcf9eabb288d7fd Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Wed, 17 Feb 2016 10:16:16 -0200
Subject: [PATCH 3/4] Avoid crash when rudp_client_close() is called.

Added a couple of pointer verifications to avoid crashes when
rudp_client_close() is called before rudp_client_connect() or at the
server_lost() handler.
---
 src/client.c | 4 ++++
 src/peer.c   | 8 ++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/client.c b/src/client.c
index 09cc56c..7fd24e2 100644
--- a/src/client.c
+++ b/src/client.c
@@ -60,6 +60,10 @@ rudp_error_t rudp_client_connect(struct rudp_client *client)
 
 rudp_error_t rudp_client_close(struct rudp_client *client)
 {
+    /* Avoid SEGFAULT in case rudp_client_connect() hasn't been called yet. */
+    if (client->peer.endpoint == NULL)
+        return 0;
+
     rudp_peer_send_close_noqueue(&client->peer);
 
     rudp_peer_deinit(&client->peer);
diff --git a/src/peer.c b/src/peer.c
index 61da260..d96c204 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -101,8 +101,12 @@ void rudp_peer_deinit(struct rudp_peer *peer)
 {
     rudp_peer_reset(peer);
     rudp_address_deinit(&peer->address);
-    ela_source_free(peer->rudp->el, peer->service_source);
-    peer->service_source = NULL;
+
+    /* Avoid SEGFAULT in case rudp_peer_deinit() is called more than once. */
+    if (peer->service_source != NULL) {
+        ela_source_free(peer->rudp->el, peer->service_source);
+        peer->service_source = NULL;
+    }
 }
 
 static void peer_update_rtt(struct rudp_peer *peer, rudp_time_t last_rtt)

From fea4326d844add4f7f8fb5e47fb4a869b9420064 Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Wed, 17 Feb 2016 10:43:01 -0200
Subject: [PATCH 4/4] Fix use of freed memory on server when peer drops.

---
 src/peer.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/peer.c b/src/peer.c
index d96c204..6c39ef4 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -338,6 +338,7 @@ rudp_error_t rudp_peer_incoming_packet(
     struct rudp_peer *peer, struct rudp_packet_chain *pc)
 {
     const struct rudp_packet_header *header = &pc->packet->header;
+    struct rudp *rudp;
 
     rudp_log_printf(peer->rudp, RUDP_LOG_IO,
                     "<<< incoming [%d] %s %s (%d) %04x:%04x\n",
@@ -399,9 +400,12 @@ rudp_error_t rudp_peer_incoming_packet(
         switch ( header->command )
         {
         case RUDP_CMD_CLOSE:
+            /* Save "rudp" here because "peer" might be freed at the dropped()
+             * handler (server). */
+            rudp = peer->rudp;
             peer->state = PEER_DEAD;
             peer->handler->dropped(peer);
-            rudp_log_printf(peer->rudp, RUDP_LOG_INFO,
+            rudp_log_printf(rudp, RUDP_LOG_INFO,
                             "      peer dropped\n");
             return 0;