DPP: Fix error path handling for GAS Comeback Response building

A local memory allocation failuring during GAS Comeback Response frame
generation could result in freeing the response context without removing
it from the list. This would result in dereferencing freed memory when
processing the next comeback request.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2018-11-25 13:51:26 +02:00
parent c7896ef9c6
commit 11f07f027a

View file

@ -260,6 +260,7 @@ gas_server_handle_rx_comeback_req(struct gas_server_response *response)
handler->adv_proto_id_len + handler->adv_proto_id_len +
resp_frag_len); resp_frag_len);
if (!resp) { if (!resp) {
dl_list_del(&response->list);
gas_server_free_response(response); gas_server_free_response(response);
return; return;
} }