jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

D-Bus (old): Fix removeNetwork method to not use freed memory

Browse source 
wpa_supplicant_deauthenticate() call needs to happen before
wpa_config_remove_network(). Freed memory could be dereferenced if
removeNetwork method was issued on the currently connected network.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-31 16:54:48 +02:00
parent f11e797d4c
commit 3a593ff5b2
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
wpa_supplicant/dbus/dbus_old_handlers.c
View file

@ -866,6 +866,10 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message,
wpas_notify_network_removed(wpa_s, ssid); wpas_notify_network_removed(wpa_s, ssid);
if (ssid == wpa_s->current_ssid)
wpa_supplicant_deauthenticate(wpa_s,
WLAN_REASON_DEAUTH_LEAVING);
if (wpa_config_remove_network(wpa_s->conf, id) < 0) { if (wpa_config_remove_network(wpa_s->conf, id) < 0) {
reply = dbus_message_new_error(message, reply = dbus_message_new_error(message,
WPAS_ERROR_REMOVE_NETWORK_ERROR, WPAS_ERROR_REMOVE_NETWORK_ERROR,
@ -874,9 +878,6 @@ DBusMessage * wpas_dbus_iface_remove_network(DBusMessage *message,
goto out; goto out;
} }
if (ssid == wpa_s->current_ssid)
wpa_supplicant_deauthenticate(wpa_s,
WLAN_REASON_DEAUTH_LEAVING);
reply = wpas_dbus_new_success_reply(message); reply = wpas_dbus_new_success_reply(message);
out: out: