DYMO: fix: double-free of RREQ wait timer when route discovery is exhausted

processRreqWaitRrepTimer() deletes the wait-timer message at the end of the
method. On the final retry (retryCount == discoveryAttemptsMax - 1) it also
called deleteRreqTimer(target), which does `delete targetAddressToRREQTimer[target]`
-- and that entry IS the message being processed -- so the message was freed
twice (and `target`, a reference into the message, dangled for the rest of the
branch). This corrupts the heap and crashes; it triggers whenever a route
discovery runs out of attempts, e.g. once nodes shut down in the DynamicIPv6
scenario. Drop the redundant cancel/delete of the timer in that branch (the
message is deleted at the end) and take `target` by value.

Enables the manetrouting/dymo DynamicIPv6 fingerprint example (was ERROR,
"IPv6: Shutdown not supported"). Recorded with tplx;~tNl;tyf like its siblings
(DYMO has no packet serializer, so ~tND is not applicable).

Author: avarga

src/inet/routing/dymo/Dymo.cc

@@ -304,11 +304,13 @@ void Dymo::scheduleRreqWaitRrepTimer(RreqWaitRrepTimer *message)
 void Dymo::processRreqWaitRrepTimer(RreqWaitRrepTimer *message)
 {
     EV_DETAIL << "Processing RREQ wait RREP timer" << endl;
-    const L3Address& target = message->getTarget();
+    // Note: 'message' is the timer stored in targetAddressToRREQTimer[target] and is
+    // deleted at the end of this method, so we must not delete it via deleteRreqTimer()
+    // here (that would double-free it). We also take 'target' by value because the
+    // reference would dangle once 'message' is deleted.
+    const L3Address target = message->getTarget();
     if (message->getRetryCount() == discoveryAttemptsMax - 1) {
         cancelRouteDiscovery(target);
-        cancelRreqTimer(target);
-        deleteRreqTimer(target);
         eraseRreqTimer(target);
         scheduleRreqHolddownTimer(createRreqHolddownTimer(target));
     }

tests/fingerprint/examples.csv

@@ -357,7 +357,7 @@
 /examples/manetrouting/dymo/,        -f omnetpp.ini -c MultiGeneric -r 0,           10s,             0354-6dd4/tplx;735c-957d/~tNl;31f0-2788/tyf, PASS,  wireless adhoc
 # /examples/manetrouting/dymo/,        -f omnetpp.ini -c _Dynamic -r 0   # abstract-config
 /examples/manetrouting/dymo/,        -f omnetpp.ini -c DynamicIPv4 -r 0,            22s,             2f57-3280/tplx;8f96-3d9c/~tNl;c33f-4f8c/tyf, PASS,  wireless adhoc Ipv4
-/examples/manetrouting/dymo/,        -f omnetpp.ini -c DynamicIPv6 -r 0,            22s,             5fe9-22ea/tplx;0000-0000/~tNl;0000-0000/~tND, ERROR, wireless adhoc # IPv6: Shutdown not supported
+/examples/manetrouting/dymo/,        -f omnetpp.ini -c DynamicIPv6 -r 0,            22s,             1e32-4f69/tplx;c684-e25f/~tNl;3469-a611/tyf, PASS,  wireless adhoc
 /examples/manetrouting/dymo/,        -f omnetpp.ini -c DynamicGeneric -r 0,         22s,             b68e-dfe3/tplx;9c68-c2d4/~tNl;8c4d-6bc7/tyf, PASS,  wireless adhoc
 
 # /examples/manetrouting/gpsr/,        -f omnetpp.ini -c Random -r 0,    # abstract-config