diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2014-04-08 01:20:24 +0300 |
|---|---|---|
| committer | Steve Kondik <shade@chemlab.org> | 2014-06-12 14:08:47 -0700 |
| commit | 1b6a5e9e2b8d6df6788090dc9ac8a693938d97aa (patch) | |
| tree | 2ca2f100ae9cdf14e7008e5a3d498e9bcfe737f3 | |
| parent | 78013255355fa36d07fb93c5f401d6da4e5ea3c3 (diff) | |
| download | android_external_wpa_supplicant_8-1b6a5e9e2b8d6df6788090dc9ac8a693938d97aa.tar.gz android_external_wpa_supplicant_8-1b6a5e9e2b8d6df6788090dc9ac8a693938d97aa.tar.bz2 android_external_wpa_supplicant_8-1b6a5e9e2b8d6df6788090dc9ac8a693938d97aa.zip | |
WNM: Fix neighbor report subelement parser to not leak memory
If a subelement is unexpectedly included multiple times, the parser must
not re-allocate memory for the entry without first freeing the old
allocation.
CRs-Fixed: 651033
Change-Id: Ib9dc7e0ba282546e29b32491db7da4a281cadf3c
Git-commit: e9cb7b9275951c1b7f70aba2d83fec91f4923f1b
Git-repo : git://w1.fi/srv/git/hostap.git
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 52dc3c8c..95e2dfff 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -329,6 +329,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, wpa_printf(MSG_DEBUG, "WNM: Too short TSF"); break; } + os_free(rep->tsf_info); rep->tsf_info = os_zalloc(sizeof(struct tsf_info)); if (rep->tsf_info == NULL) break; @@ -342,6 +343,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "country string"); break; } + os_free(rep->con_coun_str); rep->con_coun_str = os_zalloc(sizeof(struct condensed_country_string)); if (rep->con_coun_str == NULL) @@ -355,6 +357,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "candidate"); break; } + os_free(rep->bss_tran_can); rep->bss_tran_can = os_zalloc(sizeof(struct bss_transition_candidate)); if (rep->bss_tran_can == NULL) @@ -368,6 +371,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "duration"); break; } + os_free(rep->bss_term_dur); rep->bss_term_dur = os_zalloc(sizeof(struct bss_termination_duration)); if (rep->bss_term_dur == NULL) @@ -381,6 +385,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "bearing"); break; } + os_free(rep->bearing); rep->bearing = os_zalloc(sizeof(struct bearing)); if (rep->bearing == NULL) break; @@ -393,6 +398,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "pilot"); break; } + os_free(rep->meas_pilot); rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot)); if (rep->meas_pilot == NULL) break; @@ -407,6 +413,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, "capabilities"); break; } + os_free(rep->rrm_cap); rep->rrm_cap = os_zalloc(sizeof(struct rrm_enabled_capabilities)); if (rep->rrm_cap == NULL) @@ -419,6 +426,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep, wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID"); break; } + os_free(rep->mul_bssid); rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid)); if (rep->mul_bssid == NULL) break; |