lws_context_destroy dead loop

[yukuanlou]

In lws_context_destroy if the file descriptor is accidentally freed early, then in the loop while (pt->fds_count) wsi_from_fd won't be able to find wsi, and it won't be able to call lws_close_free_wsi, but this loop jumps out of the conditional fds_count--; in the lws_close_free_wsi, so it is stuck in a dead loop. It doesn't have a guaranteed mechanism for jumping out of the loop.

bugfix suggestions:

diff --git a/lib/core/context.c b/lib/core/context.c
--- a/lib/core/context.c	(revision c4b1e34a5051390438a13c50f0e57434445ce135)
+++ b/lib/core/context.c	(date 1733475213754)
@@ -1886,8 +1886,7 @@
 			/*
 			 * Close every handle in the fds
 			 */
-
-			while (pt->fds_count) {
+			for (unsigned int i = pt->fds_count; i > 0; i--) {
 				struct lws *wsi = wsi_from_fd(context,
 							      pt->fds[0].fd);
 
@@ -1904,6 +1903,9 @@
 
 					if (pt->pipe_wsi == wsi)
 						pt->pipe_wsi = NULL;
+				} else {
+					/* Prevents a dead loop when fd has already been released */
+					lwsl_err("%s: wsi is NULL! pt %d: fds_count %u \n", __func__, n, pt->fds_count);
 				}
 			}