diff options
| author | Jouni Malinen <j@w1.fi> | 2012-06-30 16:16:32 +0300 |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2012-06-30 16:16:32 +0300 |
| commit | 8350d0afd8f5a93c39c2569bd78b8f5c92f85348 (patch) | |
| tree | a3485c78951b3e73aae0b20ea5face2d565ef7d8 /src/eap_common | |
| parent | 0f27f15911c4ed68e757f3af9f65f7696a321876 (diff) | |
| download | external_wpa_supplicant_8_ti-8350d0afd8f5a93c39c2569bd78b8f5c92f85348.zip external_wpa_supplicant_8_ti-8350d0afd8f5a93c39c2569bd78b8f5c92f85348.tar.gz external_wpa_supplicant_8_ti-8350d0afd8f5a93c39c2569bd78b8f5c92f85348.tar.bz2 | |
EAP-pwd: Avoid double-frees on some error paths
At least some error paths (e.g., hitting the limit on hunt-and-peck
iterations) could have resulted in double-freeing of some memory
allocations. Avoid this by setting the pointers to NULL after they have
been freed instead of trying to free the data structure in a location
where some external references cannot be cleared. [Bug 453]
Signed-hostap: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'src/eap_common')
| -rw-r--r-- | src/eap_common/eap_pwd_common.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/eap_common/eap_pwd_common.c b/src/eap_common/eap_pwd_common.c index f85564a..c32f9fb 100644 --- a/src/eap_common/eap_pwd_common.c +++ b/src/eap_common/eap_pwd_common.c @@ -252,11 +252,13 @@ int compute_password_element(EAP_PWD_group *grp, u16 num, if (0) { fail: EC_GROUP_free(grp->group); + grp->group = NULL; EC_POINT_free(grp->pwe); + grp->pwe = NULL; BN_free(grp->order); + grp->order = NULL; BN_free(grp->prime); - os_free(grp); - grp = NULL; + grp->prime = NULL; ret = 1; } /* cleanliness and order.... */ |