From 3bd35b681689bf46e54c4cc7e3dc8b04542e07d5 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 4 Feb 2018 12:20:13 +0200 Subject: [PATCH] wpa_supplicant: Fix parsing errors on additional config file If the -I argument is used and the referenced configuration file cannot be parsed, wpa_config_read() ended up freeing the main configuration data structure and that resulted in use of freed memory in such an error case. Fix this by not freeing the main config data and handling the error case in the caller. Signed-off-by: Jouni Malinen --- wpa_supplicant/config_file.c | 3 ++- wpa_supplicant/wpa_supplicant.c | 16 ++++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c index bf0ba173c..aaee97e90 100644 --- a/wpa_supplicant/config_file.c +++ b/wpa_supplicant/config_file.c @@ -464,7 +464,8 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp) #ifndef WPA_IGNORE_CONFIG_ERRORS if (errors) { - wpa_config_free(config); + if (config != cfgp) + wpa_config_free(config); config = NULL; head = NULL; } diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 8bc9a7c58..c35121ec3 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -1010,7 +1010,13 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s) "file '%s' - exiting", wpa_s->confname); return -1; } - wpa_config_read(wpa_s->confanother, conf); + if (wpa_s->confanother && + !wpa_config_read(wpa_s->confanother, conf)) { + wpa_msg(wpa_s, MSG_ERROR, + "Failed to parse the configuration file '%s' - exiting", + wpa_s->confanother); + return -1; + } conf->changed_parameters = (unsigned int) -1; @@ -5219,7 +5225,13 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s, return -1; } wpa_s->confanother = os_rel2abs_path(iface->confanother); - wpa_config_read(wpa_s->confanother, wpa_s->conf); + if (wpa_s->confanother && + !wpa_config_read(wpa_s->confanother, wpa_s->conf)) { + wpa_printf(MSG_ERROR, + "Failed to read or parse configuration '%s'.", + wpa_s->confanother); + return -1; + } /* * Override ctrl_interface and driver_param if set on command