Merge pull request #1446 from sangshuduo/fix-use-after-free-pSql

fix use after free pSql.

src/client/src/tscAsync.c

@@ -347,8 +347,8 @@ void tscProcessAsyncRes(SSchedMsg *pMsg) {
   (*pSql->fp)(pSql->param, taosres, code);
 
   if (shouldFree) {
-    tscFreeSqlObj(pSql);
     tscTrace("%p Async sql is automatically freed in async res", pSql);
+    tscFreeSqlObj(pSql);
   }
 }
 

src/client/src/tscProfile.c

@@ -292,7 +292,7 @@ void tscKillConnection(STscObj *pObj) {
 
   pthread_mutex_unlock(&pObj->mutex);
 
-  taos_close(pObj);
-
   tscTrace("connection:%p is killed", pObj);
+
+  taos_close(pObj);
 }

src/client/src/tscServer.c

@@ -600,8 +600,8 @@ void *tscProcessMsgFromServer(char *msg, void *ahandle, void *thandle) {
           taos_close(pObj);
           tscTrace("%p Async sql close failed connection", pSql);
         } else {
-          tscFreeSqlObj(pSql);
           tscTrace("%p Async sql is automatically freed", pSql);
+          tscFreeSqlObj(pSql);
         }
       }
     }

src/client/src/tscSql.c

@@ -796,8 +796,8 @@ void taos_free_result_imp(TAOS_RES *res, int keepCmd) {
     tscTrace("%p qhandle is null, abort free, fp:%p", pSql, pSql->fp);
     if (pSql->fp != NULL) {
       pSql->thandle = NULL;
-      tscFreeSqlObj(pSql);
       tscTrace("%p Async SqlObj is freed by app", pSql);
+      tscFreeSqlObj(pSql);
     } else if (keepCmd) {
       tscFreeSqlResult(pSql);
     } else {

src/client/src/tscStream.c

@@ -582,10 +582,10 @@ void taos_close_stream(TAOS_STREAM *handle) {
     tscRemoveFromStreamList(pStream, pSql);
 
     taosTmrStopA(&(pStream->pTimer));
+    tscTrace("%p stream:%p is closed", pSql, pStream);
     tscFreeSqlObj(pSql);
     pStream->pSql = NULL;
 
-    tscTrace("%p stream:%p is closed", pSql, pStream);
     tfree(pStream);
   }
 }