DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix potential double free and use of freed memory in RADIUS client

Browse source 
ieee802_1x_encapsulate_radius() frees the RADIUS message if
radius_client_send() returns error. This could have resulted in use of
freed memory and double freeing of the RADIUS message if send() fails
since the message is also left in the retransmit list. Avoid this by not
returning error to the caller in such a case.

Signed-off-by: Alexander Couzens <lynxis@c-base.org>
This commit is contained in:
Alexander Couzens 2012-04-01 13:36:52 +03:00 committed by Jouni Malinen
parent da873dbb06
commit a4e73a0e47
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/radius/radius_client.c
View file

@ -678,7 +678,7 @@ int radius_client_send(struct radius_client_data *radius,
radius_client_list_add(radius, msg, msg_type, shared_secret, radius_client_list_add(radius, msg, msg_type, shared_secret,
shared_secret_len, addr); shared_secret_len, addr);
return res; return 0;
} }