From ec331d09a29c6b0dd5c59123688cd55f6dcdc31a Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 7 Apr 2014 13:35:18 +0300 Subject: [PATCH] WNM: Fix deinit path to clean neighbor report count wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing the allocated buffer of neighbor reports. If this function was called twice in a row without having went through new neighbor report parsing, invalid pointers could have been freed resulted in segfault. Signed-off-by: Jouni Malinen --- wpa_supplicant/wnm_sta.c | 1 + 1 file changed, 1 insertion(+) diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c index 952db0ac0..1ca4c71fa 100644 --- a/wpa_supplicant/wnm_sta.c +++ b/wpa_supplicant/wnm_sta.c @@ -319,6 +319,7 @@ void wnm_deallocate_memory(struct wpa_supplicant *wpa_s) os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid); } + wpa_s->wnm_num_neighbor_report = 0; os_free(wpa_s->wnm_neighbor_report_elements); wpa_s->wnm_neighbor_report_elements = NULL; }