aboutsummaryrefslogtreecommitdiffstats
path: root/src/radius/radius_client.c
diff options
context:
space:
mode:
authorAlexander Couzens <lynxis@c-base.org>2012-04-01 10:36:52 (GMT)
committerJouni Malinen <j@w1.fi>2012-04-01 10:36:52 (GMT)
commita4e73a0e470cde6fcf3983aca277f01540bb37fa (patch)
treef1b55f8dfa8da779a280ea22865a48681322fa2a /src/radius/radius_client.c
parentda873dbb0631ffbb3186dfbabb029cf79e829cd8 (diff)
downloadhostap-a4e73a0e470cde6fcf3983aca277f01540bb37fa.zip
hostap-a4e73a0e470cde6fcf3983aca277f01540bb37fa.tar.gz
hostap-a4e73a0e470cde6fcf3983aca277f01540bb37fa.tar.bz2
Fix potential double free and use of freed memory in RADIUS client
ieee802_1x_encapsulate_radius() frees the RADIUS message if radius_client_send() returns error. This could have resulted in use of freed memory and double freeing of the RADIUS message if send() fails since the message is also left in the retransmit list. Avoid this by not returning error to the caller in such a case. Signed-off-by: Alexander Couzens <lynxis@c-base.org>
Diffstat (limited to 'src/radius/radius_client.c')
-rw-r--r--src/radius/radius_client.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
index bcd471b..cdaeae9 100644
--- a/src/radius/radius_client.c
+++ b/src/radius/radius_client.c
@@ -678,7 +678,7 @@ int radius_client_send(struct radius_client_data *radius,
radius_client_list_add(radius, msg, msg_type, shared_secret,
shared_secret_len, addr);
- return res;
+ return 0;
}