Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-17 18:34:03 -05:00
Code Issues Projects Releases Wiki Activity

Fix external radio_work deinit path

Browse Source 
The radio_work type was stored within the dynamically allocated
wpa_radio_work buffer and that buffer ended up getting freed before the
final use of the type string within radio_work_done(). This resulted in
freed memory being used for a debug print. Avoid this by freeing the
wpa_external_work instance after having completed radio_work_done() for
the related work.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2014-03-14 20:33:56 +02:00 committed by Jouni Malinen
parent 8dd9f9cdde
commit 6829da39e6
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wpa_supplicant/ctrl_iface.c
View File

@ -5658,8 +5658,8 @@ static int wpas_ctrl_radio_work_done(struct wpa_supplicant *wpa_s, char *cmd)
"Completed external radio work %u (%s)", "Completed external radio work %u (%s)",
ework->id, ework->type); ework->id, ework->type);
eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL); eloop_cancel_timeout(wpas_ctrl_radio_work_timeout, work, NULL);
os_free(ework);
radio_work_done(work); radio_work_done(work);
os_free(ework);
return 3; /* "OK\n" */ return 3; /* "OK\n" */
} }