Clean up hostapd add_iface error path operations

If hapd_iface->bss[i] == NULL, this could have resulted in NULL pointer
dereference in the debug print. Avoid this by skipping the message in
case of NULL pointer. In addition, clear iface->bss[i] to NULL for
additional robustness even though this array gets freed immediately.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-03-02 15:29:26 +02:00
parent 67adcd266c
commit 7b6e81575f

View file

@ -1877,14 +1877,17 @@ fail:
if (hapd_iface->bss) {
for (i = 0; i < hapd_iface->num_bss; i++) {
hapd = hapd_iface->bss[i];
if (hapd && hapd_iface->interfaces &&
if (!hapd)
continue;
if (hapd_iface->interfaces &&
hapd_iface->interfaces->ctrl_iface_deinit)
hapd_iface->interfaces->
ctrl_iface_deinit(hapd);
wpa_printf(MSG_DEBUG, "%s: free hapd %p (%s)",
__func__, hapd_iface->bss[i],
hapd_iface->bss[i]->conf->iface);
os_free(hapd_iface->bss[i]);
hapd->conf->iface);
os_free(hapd);
hapd_iface->bss[i] = NULL;
}
os_free(hapd_iface->bss);
}