aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant/wnm_sta.c
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2014-04-07 10:35:18 (GMT)
committerJouni Malinen <j@w1.fi>2014-04-07 10:40:45 (GMT)
commitec331d09a29c6b0dd5c59123688cd55f6dcdc31a (patch)
tree0c23a1f3aa4328e0f92b20215cdfe844ab7fc24e /wpa_supplicant/wnm_sta.c
parentf44c45ac7f7ff208b3de84dafd784a9aae7b43ea (diff)
downloadhostap-ec331d09a29c6b0dd5c59123688cd55f6dcdc31a.zip
hostap-ec331d09a29c6b0dd5c59123688cd55f6dcdc31a.tar.gz
hostap-ec331d09a29c6b0dd5c59123688cd55f6dcdc31a.tar.bz2
WNM: Fix deinit path to clean neighbor report count
wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing the allocated buffer of neighbor reports. If this function was called twice in a row without having went through new neighbor report parsing, invalid pointers could have been freed resulted in segfault. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'wpa_supplicant/wnm_sta.c')
-rw-r--r--wpa_supplicant/wnm_sta.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 952db0a..1ca4c71 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -319,6 +319,7 @@ void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
}
+ wpa_s->wnm_num_neighbor_report = 0;
os_free(wpa_s->wnm_neighbor_report_elements);
wpa_s->wnm_neighbor_report_elements = NULL;
}