[bug] use pointer that memory had freed. (#5971)

1 files changed, 9 insertions, 4 deletions

diff --git a/components/net/at/at_socket/at_socket.c b/components/net/at/at_socket/at_socket.c
index 4a44245b48..cf15b590e0 100644
--- a/components/net/at/at_socket/at_socket.c
+++ b/components/net/at/at_socket/at_socket.c
@@ -110,9 +110,10 @@ static int at_recvpkt_all_delete(rt_slist_t *rlist)
         return 0;
     }
 
-    for(node = rt_slist_first(rlist); node; node = rt_slist_next(node))
+    for(node = rt_slist_first(rlist); node;)
     {
         pkt = rt_slist_entry(node, struct at_recv_pkt, list);
+        node = rt_slist_next(node);
         if (pkt->buff)
         {
             rt_free(pkt->buff);
@@ -157,6 +158,7 @@ static int at_recvpkt_node_delete(rt_slist_t *rlist, rt_slist_t *node)
 static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
 {
     rt_slist_t *node = RT_NULL;
+    rt_slist_t *free_node = RT_NULL;
     at_recv_pkt_t pkt = RT_NULL;
     size_t content_pos = 0, page_pos = 0;
 
@@ -165,10 +167,13 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
         return 0;
     }
 
-    for (node = rt_slist_first(rlist); node; node = rt_slist_next(node))
+    for (node = rt_slist_first(rlist); node;)
     {
         pkt = rt_slist_entry(node, struct at_recv_pkt, list);
 
+        free_node = node;
+        node = rt_slist_next(node);
+
         page_pos = pkt->bfsz_totle - pkt->bfsz_index;
 
         if (page_pos >= len - content_pos)
@@ -177,7 +182,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
             pkt->bfsz_index += len - content_pos;
             if (pkt->bfsz_index == pkt->bfsz_totle)
             {
-                at_recvpkt_node_delete(rlist, node);
+                at_recvpkt_node_delete(rlist, free_node);
             }
             content_pos = len;
             break;
@@ -187,7 +192,7 @@ static size_t at_recvpkt_get(rt_slist_t *rlist, char *mem, size_t len)
             rt_memcpy((char *) mem + content_pos, pkt->buff + pkt->bfsz_index, page_pos);
             content_pos += page_pos;
             pkt->bfsz_index += page_pos;
-            at_recvpkt_node_delete(rlist, node);
+            at_recvpkt_node_delete(rlist, free_node);
         }
     }