diff options
| author | Jouni Malinen <j@w1.fi> | 2009-11-21 12:12:49 +0200 |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2009-11-21 12:12:49 +0200 |
| commit | 7c04d5ec6c27299fc6feadcfab167a97093c976c (patch) | |
| tree | cc002f9d4e2ed26bc96ab942e16861bb7d372926 | |
| parent | b3f371cabf178935542583495ef3f51678bcf3bd (diff) | |
| download | external_wpa_supplicant_8_ti-7c04d5ec6c27299fc6feadcfab167a97093c976c.zip external_wpa_supplicant_8_ti-7c04d5ec6c27299fc6feadcfab167a97093c976c.tar.gz external_wpa_supplicant_8_ti-7c04d5ec6c27299fc6feadcfab167a97093c976c.tar.bz2 | |
WPS ER: Fix AP entry freeing on timeout
Must unlink the entry first before trying to remove it to avoid
leaving behind pointers to freed memory.
| -rw-r--r-- | src/wps/wps_er.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/src/wps/wps_er.c b/src/wps/wps_er.c index f2fa9c5..26bac70 100644 --- a/src/wps/wps_er.c +++ b/src/wps/wps_er.c @@ -268,11 +268,30 @@ static void wps_er_ap_free(struct wps_er *er, struct wps_er_ap *ap) } +static void wps_er_ap_unlink(struct wps_er *er, struct wps_er_ap *ap) +{ + struct wps_er_ap *prev, *tmp; + tmp = er->ap; + prev = NULL; + while (tmp) { + if (tmp == ap) { + if (prev) + prev->next = ap->next; + else + er->ap = ap->next; + } + prev = tmp; + tmp = tmp->next; + } +} + + static void wps_er_ap_timeout(void *eloop_data, void *user_ctx) { struct wps_er *er = eloop_data; struct wps_er_ap *ap = user_ctx; wpa_printf(MSG_DEBUG, "WPS ER: AP advertisement timed out"); + wps_er_ap_unlink(er, ap); wps_er_ap_free(er, ap); } |