DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix MAC ACL query freeing on deinit

Browse source 
hapd->acl_cache and hapd->acl_queries were not reset back to NULL in
hostapd_acl_deinit() when cached results and pending ACL queries were
freed. This left stale pointers to freed memory in hapd. While this was
normally followed by freeing of the hapd data, it is possible to re-use
that hapd when disabling and re-enabling an interface. That sequence
could result in use of freed memory if done while there were cached
results or pending ACL operations with a RADIUS server (especially, if
that server did not reply).

Fix this by setting hapd->acl_queries to NULL when the pending entries
are freed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2017-02-08 17:37:50 +02:00 committed by Jouni Malinen
parent b3f32a24d4
commit bd6ec7f7ca
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/ap/ieee802_11_auth.c
View file

@ -665,9 +665,11 @@ void hostapd_acl_deinit(struct hostapd_data *hapd)
#ifndef CONFIG_NO_RADIUS #ifndef CONFIG_NO_RADIUS
hostapd_acl_cache_free(hapd->acl_cache); hostapd_acl_cache_free(hapd->acl_cache);
hapd->acl_cache = NULL;
#endif /* CONFIG_NO_RADIUS */ #endif /* CONFIG_NO_RADIUS */
query = hapd->acl_queries; query = hapd->acl_queries;
hapd->acl_queries = NULL;
while (query) { while (query) {
prev = query; prev = query;
query = query->next; query = query->next;