aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHaim Dreyfuss <haim.dreyfuss@intel.com>2015-01-19 01:44:39 (GMT)
committerJouni Malinen <j@w1.fi>2015-01-20 00:14:19 (GMT)
commitb62b0cb78a741cfe288feb97e4da540a7c872d00 (patch)
tree69d5d479d4a53dca9e3966b69e55ceca5bfd2e7e
parent9bd02739314d483ed0f583feef8081092ca5a5ca (diff)
downloadhostap-b62b0cb78a741cfe288feb97e4da540a7c872d00.zip
hostap-b62b0cb78a741cfe288feb97e4da540a7c872d00.tar.gz
hostap-b62b0cb78a741cfe288feb97e4da540a7c872d00.tar.bz2
WNM: Fix possible memory leak by free buf
Buf is allocated and may not be freed on an error path. Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
-rw-r--r--src/ap/wnm_ap.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 7e8fb5c..4c8bc10 100644
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -564,8 +564,11 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
if (url) {
/* Session Information URL */
url_len = os_strlen(url);
- if (url_len > 255)
+ if (url_len > 255) {
+ os_free(buf);
return -1;
+ }
+
*pos++ = url_len;
os_memcpy(pos, url, url_len);
pos += url_len;