jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

driver_ralink: Make sure assoc_{req,resp}_ies do not get double-freed

Browse source
This commit is contained in:
Jouni Malinen 2008-02-27 17:53:22 -08:00
parent 5e77500c4f
commit 4d6c3de3df
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/drivers/driver_ralink.c
View file

@ -640,7 +640,7 @@ wpa_driver_ralink_event_wireless(struct wpa_driver_ralink_data *drv,
"receive ASSOCINFO_EVENT !!!"); "receive ASSOCINFO_EVENT !!!");
assoc_info_buf = assoc_info_buf =
os_malloc(drv->assoc_req_ies_len + os_zalloc(drv->assoc_req_ies_len +
drv->assoc_resp_ies_len + 1); drv->assoc_resp_ies_len + 1);
if (assoc_info_buf == NULL) { if (assoc_info_buf == NULL) {
@ -652,18 +652,26 @@ wpa_driver_ralink_event_wireless(struct wpa_driver_ralink_data *drv,
return; return;
} }
os_memcpy(assoc_info_buf, drv->assoc_req_ies, if (drv->assoc_req_ies) {
os_memcpy(assoc_info_buf,
drv->assoc_req_ies,
drv->assoc_req_ies_len); drv->assoc_req_ies_len);
}
info_pos = assoc_info_buf + info_pos = assoc_info_buf +
drv->assoc_req_ies_len; drv->assoc_req_ies_len;
os_memcpy(info_pos, drv->assoc_resp_ies, if (drv->assoc_resp_ies) {
os_memcpy(info_pos,
drv->assoc_resp_ies,
drv->assoc_resp_ies_len); drv->assoc_resp_ies_len);
}
assoc_info_buf[drv->assoc_req_ies_len + assoc_info_buf[drv->assoc_req_ies_len +
drv->assoc_resp_ies_len] = '\0'; drv->assoc_resp_ies_len] = '\0';
wpa_driver_ralink_event_wireless_custom( wpa_driver_ralink_event_wireless_custom(
drv, ctx, assoc_info_buf); drv, ctx, assoc_info_buf);
os_free(drv->assoc_req_ies); os_free(drv->assoc_req_ies);
drv->assoc_req_ies = NULL;
os_free(drv->assoc_resp_ies); os_free(drv->assoc_resp_ies);
drv->assoc_resp_ies = NULL;
os_free(assoc_info_buf); os_free(assoc_info_buf);
} else if (iwe->u.data.flags == RT_DISASSOC_EVENT_FLAG) } else if (iwe->u.data.flags == RT_DISASSOC_EVENT_FLAG)
{ {