From 4b1389e6d8f60ece6a4e4770fc37446f2613cf34 Mon Sep 17 00:00:00 2001
From: Ian Craggs <icraggs@gmail.com>
Date: Thu, 10 Feb 2022 18:09:15 +0000
Subject: [PATCH] Correct freeing of some persistence buffers

---
 src/MQTTAsyncUtils.c  | 8 ++++----
 src/MQTTPersistence.c | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/MQTTAsyncUtils.c b/src/MQTTAsyncUtils.c
index 55056906..a6dd71b7 100644
--- a/src/MQTTAsyncUtils.c
+++ b/src/MQTTAsyncUtils.c
@@ -662,14 +662,14 @@ int MQTTAsync_restoreCommands(MQTTAsyncs* client)
 					cmd->seqno = atoi(strchr(msgkeys[i], '-')+1); /* key format is tag'-'seqno */
 					/* we can just append the commands to the list as they've already been sorted */
 					ListAppend(MQTTAsync_commands, cmd, sizeof(MQTTAsync_queuedCommand));
-					if (buffer)
-						free(buffer);
 					client->command_seqno = max(client->command_seqno, cmd->seqno);
 					commands_restored++;
 					if (cmd->command.type == PUBLISH)
 						client->noBufferedMessages++;
 				}
 			}
+			if (buffer)
+				free(buffer);
 			if (msgkeys[i])
 				free(msgkeys[i]);
 			i++;
@@ -1246,11 +1246,11 @@ static int MQTTAsync_processCommand(void)
 					free(command->key);
 					command->key = NULL;
 					command = MQTTAsync_restoreCommand(buffer, buflen, MQTTVersion, command);
-					if (buffer)
-						free(buffer);
 				}
 				else
 					Log(LOG_ERROR, -1, "Error restoring command: rc %d from pget\n", rc);
+				if (buffer)
+					free(buffer);
 			}
 			MQTTAsync_unpersistCommand(command);
 		}
diff --git a/src/MQTTPersistence.c b/src/MQTTPersistence.c
index 7c156245..7e6e11e8 100644
--- a/src/MQTTPersistence.c
+++ b/src/MQTTPersistence.c
@@ -886,10 +886,11 @@ int MQTTPersistence_restoreMessageQueue(Clients* c)
 				{	
 					qe->seqno = atoi(strchr(msgkeys[i], '-')+1); /* key format is tag'-'seqno */
 					MQTTPersistence_insertInSeqOrder(c->messageQueue, qe, sizeof(MQTTPersistence_qEntry));
-					free(buffer);
 					c->qentry_seqno = max(c->qentry_seqno, qe->seqno);
 					entries_restored++;
 				}
+				if (buffer)
+					free(buffer);
 			}
 			if (msgkeys[i])
 			{