Merge pull request #1561 from taosdata/fix-use-after-free-issues

fix use-after-free issues.

src/client/src/tscAsync.c

@@ -342,8 +342,8 @@ void tscProcessAsyncRes(SSchedMsg *pMsg) {
   (*pSql->fp)(pSql->param, taosres, code);
 
   if (shouldFree) {
-    tscFreeSqlObj(pSql);
     tscTrace("%p Async sql is automatically freed in async res", pSql);
+    tscFreeSqlObj(pSql);
   }
 }
 

src/client/src/tscProfile.c

@@ -292,7 +292,6 @@ void tscKillConnection(STscObj *pObj) {
 
   pthread_mutex_unlock(&pObj->mutex);
 
-  taos_close(pObj);
-
   tscTrace("connection:%p is killed", pObj);
+  taos_close(pObj);
 }

src/client/src/tscServer.c

@@ -343,8 +343,8 @@ void tscProcessMsgFromServer(SRpcMsg *rpcMsg) {
     (*pSql->fp)(pSql->param, taosres, rpcMsg->code);
 
     if (shouldFree) {
-      tscFreeSqlObj(pSql);
       tscTrace("%p Async sql is automatically freed", pSql);
+      tscFreeSqlObj(pSql);
     }
   }
 

src/client/src/tscSql.c

@@ -757,8 +757,8 @@ void taos_free_result_imp(TAOS_RES *res, int keepCmd) {
     tscTrace("%p qhandle is null, abort free, fp:%p", pSql, pSql->fp);
     
     if (tscShouldFreeAsyncSqlObj(pSql)) {
-      tscFreeSqlObj(pSql);
       tscTrace("%p Async SqlObj is freed by app", pSql);
+      tscFreeSqlObj(pSql);
     } else {
       if (keepCmd) {
         tscFreeSqlResult(pSql);

src/client/src/tscStream.c

@@ -582,10 +582,12 @@ void taos_close_stream(TAOS_STREAM *handle) {
     tscRemoveFromStreamList(pStream, pSql);
 
     taosTmrStopA(&(pStream->pTimer));
+
+    tscTrace("%p stream:%p is closed", pSql, pStream);
+
     tscFreeSqlObj(pSql);
     pStream->pSql = NULL;
 
-    tscTrace("%p stream:%p is closed", pSql, pStream);
     tfree(pStream);
   }
 }