DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix external radio work stopping to not read freed memory

Browse source 
The dynamically allocated struct wpa_external_work contains the name of
the radio work in the type field and this is used in a debug print
within radio_work_done(). Re-order radio_work_done() and os_free() calls
on couple of paths where the memory was freed before that final user of
the buffer.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-05-31 22:58:51 +03:00
parent 13c330385a
commit df48efc5ab
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
wpa_supplicant/ctrl_iface.c
View file

@ -5808,8 +5808,8 @@ static void wpas_ctrl_radio_work_timeout(void *eloop_ctx, void *timeout_ctx)
"Timing out external radio work %u (%s)", "Timing out external radio work %u (%s)",
ework->id, work->type); ework->id, work->type);
wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id); wpa_msg(work->wpa_s, MSG_INFO, EXT_RADIO_WORK_TIMEOUT "%u", ework->id);
os_free(ework);
radio_work_done(work); radio_work_done(work);
os_free(ework);
} }
@ -5951,8 +5951,8 @@ void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
if (work->started) if (work->started)
eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, eloop_cancel_timeout(wpas_ctrl_radio_work_timeout,
work, NULL); work, NULL);
os_free(ework);
radio_work_done(work); radio_work_done(work);
os_free(ework);
} }
} }