DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix memory leak in hostapd BSS_TM_REQ error path handling

Browse source 
The optional url=<URL> parameter was stored in allocated memory and that
memory was leaked if some following parameter parsing attempts failed.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2016-12-27 19:08:31 +02:00
parent def947b771
commit fd5f29e7ed
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
hostapd/ctrl_iface.c
View file

@ -1017,14 +1017,16 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
if (ret != 3) { if (ret != 3) {
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"MBO requires three arguments: mbo=<reason>:<reassoc_delay>:<cell_pref>"); "MBO requires three arguments: mbo=<reason>:<reassoc_delay>:<cell_pref>");
return -1; ret = -1;
goto fail;
} }
if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP) { if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP) {
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"Invalid MBO transition reason code %u", "Invalid MBO transition reason code %u",
mbo_reason); mbo_reason);
return -1; ret = -1;
goto fail;
} }
/* Valid values for Cellular preference are: 0, 1, 255 */ /* Valid values for Cellular preference are: 0, 1, 255 */
@ -1032,7 +1034,8 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"Invalid MBO cellular capability %u", "Invalid MBO cellular capability %u",
cell_pref); cell_pref);
return -1; ret = -1;
goto fail;
} }
if (reassoc_delay > 65535 || if (reassoc_delay > 65535 ||
@ -1040,7 +1043,8 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
!(req_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT))) { !(req_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT))) {
wpa_printf(MSG_DEBUG, wpa_printf(MSG_DEBUG,
"MBO: Assoc retry delay is only valid in disassoc imminent mode"); "MBO: Assoc retry delay is only valid in disassoc imminent mode");
return -1; ret = -1;
goto fail;
} }
*mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON; *mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON;
@ -1066,6 +1070,7 @@ static int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
nei_pos > nei_rep ? nei_rep : NULL, nei_pos > nei_rep ? nei_rep : NULL,
nei_pos - nei_rep, mbo_len ? mbo : NULL, nei_pos - nei_rep, mbo_len ? mbo : NULL,
mbo_len); mbo_len);
fail:
os_free(url); os_free(url);
return ret; return ret;
} }