diff options
| author | Jouni Malinen <j@w1.fi> | 2009-11-20 21:56:39 +0200 |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2009-11-20 21:56:39 +0200 |
| commit | 7c009db2a652acefea5831bbecfbb88fc5087208 (patch) | |
| tree | 88b752eaed83c2585e06800b1b3bdbf1e1f1dede | |
| parent | a3c6598fcd896420997f38d973dc79b8ef200df5 (diff) | |
| download | external_wpa_supplicant_8_ti-7c009db2a652acefea5831bbecfbb88fc5087208.zip external_wpa_supplicant_8_ti-7c009db2a652acefea5831bbecfbb88fc5087208.tar.gz external_wpa_supplicant_8_ti-7c009db2a652acefea5831bbecfbb88fc5087208.tar.bz2 | |
WPS ER: Fix Enrollee entry freeing on timeout
Must unlink the entry first before trying to remove it to avoid
leaving behind pointers to freed memory.
| -rw-r--r-- | src/wps/wps_er.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/src/wps/wps_er.c b/src/wps/wps_er.c index 2887f04..4a6e6f7 100644 --- a/src/wps/wps_er.c +++ b/src/wps/wps_er.c @@ -676,8 +676,22 @@ static void wps_er_http_resp_ok(struct http_request *req) static void wps_er_sta_timeout(void *eloop_data, void *user_ctx) { - struct wps_er_sta *sta = eloop_data; + struct wps_er_sta *prev, *tmp, *sta = eloop_data; wpa_printf(MSG_DEBUG, "WPS ER: STA entry timed out"); + tmp = sta->ap->sta; + prev = NULL; + while (tmp) { + if (tmp == sta) + break; + prev = tmp; + tmp = tmp->next; + } + if (tmp) { + if (prev) + prev->next = sta->next; + else + sta->ap->sta = sta->next; + } wps_er_sta_free(sta); } |