Call of monitored item delete callback with invalid subscription context

[the-om]

Description

When calling __UA_Client_MonitoredItems_create, __UA_Client_Service can close the connection (if receiveServiceResponse returns UA_STATUSCODE_GOODNONCRITICALTIMEOUT), which causes the subscription to be deleted that the monitored item was supposed to be added to.
__UA_Client_MonitoredItems_create does not check if this happened, which then causes the monitored item delete callback to be called during cleanup with nonzero subscription id and non-null subscription context, even though the subscription is already gone.

Background Information / Reproduction Steps

I can reproduce this behaviour by stepping through __UA_Client_Service with a debugger which can trigger the noncriticaltimeout case.

#include <open62541/client.h>
#include <open62541/client_subscriptions.h>
#include <open62541/client_config_default.h>
#include <stdio.h>


struct SubContext {
	int i;
};

struct MonContext {
	int i;
};

void onSubDelete(UA_Client* client, UA_UInt32 subid, void* sub_context) {
	puts("Subscription deleted");
}

void onChange(UA_Client *client, UA_UInt32 subId, void *subContext, UA_UInt32 monId, void *monContext, UA_DataValue *value) {}

void onMonItemDelete(UA_Client* client, UA_UInt32 subid, void* sub_context, UA_UInt32 monid, void* monContext) {
	printf("Monitored Item deleted subid=%u sub_context=%p\n", (unsigned)subid, sub_context);
}

int main() {
	UA_StatusCode status;
	UA_Client* client = UA_Client_new();
	status = UA_ClientConfig_setDefault(UA_Client_getConfig(client));
	status = UA_Client_connect(client, "opc.tcp:https://localhost:62541");

	struct SubContext sub_context = { 0 };
	UA_CreateSubscriptionRequest req = { 0 };
	UA_CreateSubscriptionResponse resp;
	resp = UA_Client_Subscriptions_create(client, req, &sub_context, NULL, onSubDelete);
	UA_UInt32 sub_id = resp.subscriptionId;
	UA_CreateSubscriptionResponse_deleteMembers(&resp);

	struct MonContext monitem_context = { 0 };
	UA_MonitoredItemCreateRequest mreq =  =
		UA_MonitoredItemCreateRequest_default(UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_SERVERSTATUS_CURRENTTIME));
	UA_MonitoredItemCreateResult mresp;
	mresp = UA_Client_MonitoredItems_createDataChange(client, sub_id, UA_TIMESTAMPSTORETURN_NEITHER, mreq, &monitem_context, onChange, onMonItemDelete);
	if(mresp.statusCode != UA_STATUSCODE_GOOD) {
		puts(UA_StatusCode_name(mresp.statusCode));
	}
	UA_MonitoredItemCreateResult_deleteMembers(&mresp);

	UA_Client_delete(client);

	return 0;
}

Checklist

• open62541 Version (release number or git tag): d070a2f (master)
• Other OPC UA SDKs used (client or server):
• Operating system: Windows 10
• Logs (with UA_LOGLEVEL set as low as necessary) attached
• Wireshark network dump attached
• Self-contained code example attached
• Critical issue