$OpenBSD: patch-src_client_ua_client_subscriptions_c,v 1.1 2021/08/13 15:30:13 bluhm Exp $

Newer versions added this check in __MonitoredItems_create_handler()
which is called ua_MonitoredItems_create() in master.  It prevents
a use after free in the monitored items delete callback.
https://github.com/open62541/open62541/commit/a89d04e1c7c70fbb9745d7875d8b94eb2a1aa53e

Index: src/client/ua_client_subscriptions.c
--- src/client/ua_client_subscriptions.c.orig
+++ src/client/ua_client_subscriptions.c
@@ -252,6 +252,12 @@ __UA_Client_MonitoredItems_create(UA_Client *client,
     /* Call the service */
     __UA_Client_Service(client, request, &UA_TYPES[UA_TYPES_CREATEMONITOREDITEMSREQUEST],
                         response, &UA_TYPES[UA_TYPES_CREATEMONITOREDITEMSRESPONSE]);
+
+    /* __UA_Client_Service might free Subscription, check if it still exists */
+    sub = findSubscription(client, request->subscriptionId);
+    if(!sub)
+        goto cleanup;
+
     if(response->responseHeader.serviceResult != UA_STATUSCODE_GOOD)
         goto cleanup;
 
