DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

WNM: Fix deinit path to clean neighbor report count

Browse source 
wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing
the allocated buffer of neighbor reports. If this function was called
twice in a row without having went through new neighbor report parsing,
invalid pointers could have been freed resulted in segfault.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2014-04-07 13:35:18 +03:00 committed by Jouni Malinen
parent f44c45ac7f
commit ec331d09a2
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
wpa_supplicant/wnm_sta.c
View file

@ -319,6 +319,7 @@ void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid); os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
} }
wpa_s->wnm_num_neighbor_report = 0;
os_free(wpa_s->wnm_neighbor_report_elements); os_free(wpa_s->wnm_neighbor_report_elements);
wpa_s->wnm_neighbor_report_elements = NULL; wpa_s->wnm_neighbor_report_elements = NULL;
} }