diff options
| author | Jouni Malinen <jouni@qca.qualcomm.com> | 2014-04-07 13:35:18 +0300 |
|---|---|---|
| committer | Steve Kondik <shade@chemlab.org> | 2014-06-12 14:08:47 -0700 |
| commit | e212bad50b1c4f225c87bee1c3b9ba81a4504773 (patch) | |
| tree | 02e1dba07da1c9cf967e010517b59a9ee54b69a7 | |
| parent | 6c233a040607e1256b44c7db055982a16dd628cd (diff) | |
| download | android_external_wpa_supplicant_8-e212bad50b1c4f225c87bee1c3b9ba81a4504773.tar.gz android_external_wpa_supplicant_8-e212bad50b1c4f225c87bee1c3b9ba81a4504773.tar.bz2 android_external_wpa_supplicant_8-e212bad50b1c4f225c87bee1c3b9ba81a4504773.zip | |
WNM: Fix deinit path to clean neighbor report count
wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing
the allocated buffer of neighbor reports. If this function was called
twice in a row without having went through new neighbor report parsing,
invalid pointers could have been freed resulted in segfault.
CRs-Fixed: 651033
Change-Id: If11be7c57365bedc65d3c5fe31f42aceec65c74a
Git-commit: ec331d09a29c6b0dd5c59123688cd55f6dcdc31a
Git-repo : git://w1.fi/srv/git/hostap.git
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
| -rw-r--r-- | wpa_supplicant/wnm_sta.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 4f8d895a..5731cbd5 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -314,6 +314,7 @@ void wnm_deallocate_memory(struct wpa_supplicant *wpa_s) os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid); } + wpa_s->wnm_num_neighbor_report = 0; os_free(wpa_s->wnm_neighbor_report_elements); wpa_s->wnm_neighbor_report_elements = NULL; } |