In the registration_handleRequest processing flow, there may be an invalid pointer in the contextP->clientList linked list

[Solstice1993]

In lines 1896 and 1901 of the function registration_handleRequest, when the function prv_getLocationString and coap_set_header_location_path fail to check, the function registration_freeClient will be called to release the clientP node, but at this time the clientP node is not removed from contextP->clientList, resulting in subsequent access to invalid pointers.

            if (prv_getLocationString(clientP->internalID, location) == 0)
            {
                registration_freeClient(clientP);
                return COAP_500_INTERNAL_SERVER_ERROR;
            }
            if (coap_set_header_location_path(response, location) == 0)
            {
                registration_freeClient(clientP);
                return COAP_500_INTERNAL_SERVER_ERROR;
            }