wpa_supplicant: Fix parsing errors on additional config file

If the -I<config> argument is used and the referenced configuration file
cannot be parsed, wpa_config_read() ended up freeing the main
configuration data structure and that resulted in use of freed memory in
such an error case. Fix this by not freeing the main config data and
handling the error case in the caller.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2018-02-04 12:20:13 +02:00
parent 9c5fe742a2
commit 3bd35b6816
2 changed files with 16 additions and 3 deletions

View file

@ -464,7 +464,8 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
#ifndef WPA_IGNORE_CONFIG_ERRORS #ifndef WPA_IGNORE_CONFIG_ERRORS
if (errors) { if (errors) {
wpa_config_free(config); if (config != cfgp)
wpa_config_free(config);
config = NULL; config = NULL;
head = NULL; head = NULL;
} }

View file

@ -1010,7 +1010,13 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
"file '%s' - exiting", wpa_s->confname); "file '%s' - exiting", wpa_s->confname);
return -1; return -1;
} }
wpa_config_read(wpa_s->confanother, conf); if (wpa_s->confanother &&
!wpa_config_read(wpa_s->confanother, conf)) {
wpa_msg(wpa_s, MSG_ERROR,
"Failed to parse the configuration file '%s' - exiting",
wpa_s->confanother);
return -1;
}
conf->changed_parameters = (unsigned int) -1; conf->changed_parameters = (unsigned int) -1;
@ -5219,7 +5225,13 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
return -1; return -1;
} }
wpa_s->confanother = os_rel2abs_path(iface->confanother); wpa_s->confanother = os_rel2abs_path(iface->confanother);
wpa_config_read(wpa_s->confanother, wpa_s->conf); if (wpa_s->confanother &&
!wpa_config_read(wpa_s->confanother, wpa_s->conf)) {
wpa_printf(MSG_ERROR,
"Failed to read or parse configuration '%s'.",
wpa_s->confanother);
return -1;
}
/* /*
* Override ctrl_interface and driver_param if set on command * Override ctrl_interface and driver_param if set on command