[BiC] Fix dangling pointer dereferencing when destroying QMqttClient

when QMqttClient gets destroyed in Connected state, d->m_connection
in its destructor (indirectly called by ~QObject) sends DISCONNECT
Control packet and then closes connection, causing
transportConnectionClosed() to call m_clientPrivate->setStateAndError(),
which, in its turn, accesses [a partially destroyed] QMqttClient instance

Change-Id: I216f700d92838dc25e385fe2d449f3ad93a642e6
Reviewed-by: Maurice Kalinowski <maurice.kalinowski@qt.io>

2 files changed, 10 insertions, 0 deletions

diff --git a/src/mqtt/qmqttclient.cpp b/src/mqtt/qmqttclient.cpp
index 214c0c0..5fe62e3 100644
--- a/src/mqtt/qmqttclient.cpp
+++ b/src/mqtt/qmqttclient.cpp
@@ -347,6 +347,15 @@ QMqttClient::QMqttClient(QObject *parent) : QObject(*(new QMqttClientPrivate(thi
 }
 
 /*!
+    Deletes a MQTT client. If the MQTT client was not already disconnected from the MQTT broker,
+    it will be disconnected from automatically.
+*/
+QMqttClient::~QMqttClient()
+{
+    disconnectFromHost();
+}
+
+/*!
     Sets the transport to \a device. A transport can be either a socket type
     or derived from QIODevice and is specified by \a transport.
 
diff --git a/src/mqtt/qmqttclient.h b/src/mqtt/qmqttclient.h
index 86df871..f386d4e 100644
--- a/src/mqtt/qmqttclient.h
+++ b/src/mqtt/qmqttclient.h
@@ -111,6 +111,7 @@ private:
     Q_PROPERTY(bool autoKeepAlive READ autoKeepAlive WRITE setAutoKeepAlive NOTIFY autoKeepAliveChanged)
 public:
     explicit QMqttClient(QObject *parent = nullptr);
+    ~QMqttClient() override;
 
     void setTransport(QIODevice *device, TransportType transport);
     QIODevice *transport() const;