From cf7a576f67fd814e4cd407c9828a72e5cf4b83c4 Mon Sep 17 00:00:00 2001
From: Dan Williams <dcbw@redhat.com>
Date: Wed, 5 Mar 2008 16:15:10 +0200
Subject: [PATCH] Fix potential use-after-free in dbus byte array demarshaling
 code

The byte array code should be clearing its own pointer, not the string
array pointer.
---
 wpa_supplicant/dbus_dict_helpers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wpa_supplicant/dbus_dict_helpers.c b/wpa_supplicant/dbus_dict_helpers.c
index 1232ab29c..d81097914 100644
--- a/wpa_supplicant/dbus_dict_helpers.c
+++ b/wpa_supplicant/dbus_dict_helpers.c
@@ -674,7 +674,7 @@ static dbus_bool_t _wpa_dbus_dict_entry_get_byte_array(
 	/* Zero-length arrays are valid. */
 	if (entry->array_len == 0) {
 		free(entry->bytearray_value);
-		entry->strarray_value = NULL;
+		entry->bytearray_value = NULL;
 	}
 
 	success = TRUE;