aboutsummaryrefslogtreecommitdiffstats
path: root/hostapd
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2013-11-05 23:15:28 (GMT)
committerJouni Malinen <j@w1.fi>2013-11-05 23:15:28 (GMT)
commit8540e0b520062e95e42f8e213b12f8a2f552b22c (patch)
treed17fff6c779c9fee959c802de109a074e5fba96b /hostapd
parent742117ad880757ec298751cabdc789db99a49112 (diff)
downloadhostap-8540e0b520062e95e42f8e213b12f8a2f552b22c.zip
hostap-8540e0b520062e95e42f8e213b12f8a2f552b22c.tar.gz
hostap-8540e0b520062e95e42f8e213b12f8a2f552b22c.tar.bz2
hostapd: Fix DETACH command debug prints to avoid use of freed memory
In case a control interface socket is detached because of sendmsg() failing for the socket, function call to detach the socket uses a pointer to the socket information in the structure to be freed. Reorder code to print socket info before freeing the data to avoid use of freed memory in case debug prints are enabled. This is similar to the earlier wpa_supplicant fix in commit a235aca316a8a4729735fecb00f7d7775b38d993. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'hostapd')
-rw-r--r--hostapd/ctrl_iface.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
index cea96eb..3f181fa 100644
--- a/hostapd/ctrl_iface.c
+++ b/hostapd/ctrl_iface.c
@@ -82,15 +82,15 @@ static int hostapd_ctrl_iface_detach(struct hostapd_data *hapd,
os_memcmp(from->sun_path, dst->addr.sun_path,
fromlen - offsetof(struct sockaddr_un, sun_path))
== 0) {
+ wpa_hexdump(MSG_DEBUG, "CTRL_IFACE monitor detached",
+ (u8 *) from->sun_path,
+ fromlen -
+ offsetof(struct sockaddr_un, sun_path));
if (prev == NULL)
hapd->ctrl_dst = dst->next;
else
prev->next = dst->next;
os_free(dst);
- wpa_hexdump(MSG_DEBUG, "CTRL_IFACE monitor detached",
- (u8 *) from->sun_path,
- fromlen -
- offsetof(struct sockaddr_un, sun_path));
return 0;
}
prev = dst;