DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

hostapd: Fix DETACH command debug prints to avoid use of freed memory

Browse source 
In case a control interface socket is detached because of sendmsg()
failing for the socket, function call to detach the socket uses a
pointer to the socket information in the structure to be freed. Reorder
code to print socket info before freeing the data to avoid use of freed
memory in case debug prints are enabled.

This is similar to the earlier wpa_supplicant fix in commit
a235aca316.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2013-11-06 01:15:28 +02:00 committed by Jouni Malinen
parent 742117ad88
commit 8540e0b520
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
hostapd/ctrl_iface.c
View file

@ -82,15 +82,15 @@ static int hostapd_ctrl_iface_detach(struct hostapd_data *hapd,
os_memcmp(from->sun_path, dst->addr.sun_path, os_memcmp(from->sun_path, dst->addr.sun_path,
fromlen - offsetof(struct sockaddr_un, sun_path)) fromlen - offsetof(struct sockaddr_un, sun_path))
== 0) { == 0) {
wpa_hexdump(MSG_DEBUG, "CTRL_IFACE monitor detached",
(u8 *) from->sun_path,
fromlen -
offsetof(struct sockaddr_un, sun_path));
if (prev == NULL) if (prev == NULL)
hapd->ctrl_dst = dst->next; hapd->ctrl_dst = dst->next;
else else
prev->next = dst->next; prev->next = dst->next;
os_free(dst); os_free(dst);
wpa_hexdump(MSG_DEBUG, "CTRL_IFACE monitor detached",
(u8 *) from->sun_path,
fromlen -
offsetof(struct sockaddr_un, sun_path));
return 0; return 0;
} }
prev = dst; prev = dst;