MQTTProtocol_emptyMessageList() crashes due to null pointer assignment

[clappingSeal14]

Describe the bug
Within the function MQTTProtocol_emptyMessageList() in MQTTProtocolClient.c when the function attempts to assign the variable Messages* m to current->content it is attempting to assign a null pointer and it crashes.

When the stack trace for the segmentation fault is viewed this call to MQTTProtocol_emptyMessageList() occurs due to a previous call handled in the system to MQTTClient_destroy(). It appears to be having trouble freeing the inbound message list for the client getting destroyed.

For our project we brought in the repository as a submodule and are using the source code of PAHO to handle our MQTT logic. All of our business logic is handled on one thread while all of the MQTT logic is handled on the second thread.

Additional Information

• The client that is being destroyed is not null and has valid fields
• After reading similar issues to this, increased the inflight messagetimeout being used to 10000ms but the system still crashed

To Reproduce
When performing network stress tests of the system that receives a message from the broker every 1000ms and responds to it, this behavior is seen when a device in our application has it's connection loss leading us to destroy the previously existing client. This failure does not occur for every call to MQTTClient_destroy() however it is more likely to appear the longer the stress test runs.

Expected behavior
Application behaves as normal without unexpected crashing

Screenshots
Stack trace of the segmentation fault:

Value of msgList within the function causing the segmentation fault (size appears unreasonable):

Log files
NewestGdbDump.txt

Environment:

• Host OS: Ubuntu
• Remote Debug Target: Linux beaglebone 4.19.94-ti-r42 #1buster SMP PREEMPT Tue Mar 31 19:38:29 UTC 2020 armv7l GNU/Linux (Debian IOT)
• PAHO MQTT Version: 1.3.13