Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-17 18:34:03 -05:00
Code Issues Projects Releases Wiki Activity

WNM: Fix neighbor report subelement parser to not leak memory

Browse Source 
If a subelement is unexpectedly included multiple times, the parser must
not re-allocate memory for the entry without first freeing the old
allocation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2014-04-08 01:20:24 +03:00 committed by Jouni Malinen
parent 1aa6f953bb
commit e9cb7b9275
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wpa_supplicant/wnm_sta.c
View File

@ -334,6 +334,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
wpa_printf(MSG_DEBUG, "WNM: Too short TSF"); wpa_printf(MSG_DEBUG, "WNM: Too short TSF");
break; break;
} }
os_free(rep->tsf_info);
rep->tsf_info = os_zalloc(sizeof(struct tsf_info)); rep->tsf_info = os_zalloc(sizeof(struct tsf_info));
if (rep->tsf_info == NULL) if (rep->tsf_info == NULL)
break; break;
@ -347,6 +348,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"country string"); "country string");
break; break;
} }
os_free(rep->con_coun_str);
rep->con_coun_str = rep->con_coun_str =
os_zalloc(sizeof(struct condensed_country_string)); os_zalloc(sizeof(struct condensed_country_string));
if (rep->con_coun_str == NULL) if (rep->con_coun_str == NULL)
@ -360,6 +362,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"candidate"); "candidate");
break; break;
} }
os_free(rep->bss_tran_can);
rep->bss_tran_can = rep->bss_tran_can =
os_zalloc(sizeof(struct bss_transition_candidate)); os_zalloc(sizeof(struct bss_transition_candidate));
if (rep->bss_tran_can == NULL) if (rep->bss_tran_can == NULL)
@ -373,6 +376,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"duration"); "duration");
break; break;
} }
os_free(rep->bss_term_dur);
rep->bss_term_dur = rep->bss_term_dur =
os_zalloc(sizeof(struct bss_termination_duration)); os_zalloc(sizeof(struct bss_termination_duration));
if (rep->bss_term_dur == NULL) if (rep->bss_term_dur == NULL)
@ -386,6 +390,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"bearing"); "bearing");
break; break;
} }
os_free(rep->bearing);
rep->bearing = os_zalloc(sizeof(struct bearing)); rep->bearing = os_zalloc(sizeof(struct bearing));
if (rep->bearing == NULL) if (rep->bearing == NULL)
break; break;
@ -398,6 +403,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"pilot"); "pilot");
break; break;
} }
os_free(rep->meas_pilot);
rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot)); rep->meas_pilot = os_zalloc(sizeof(struct measurement_pilot));
if (rep->meas_pilot == NULL) if (rep->meas_pilot == NULL)
break; break;
@ -412,6 +418,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
"capabilities"); "capabilities");
break; break;
} }
os_free(rep->rrm_cap);
rep->rrm_cap = rep->rrm_cap =
os_zalloc(sizeof(struct rrm_enabled_capabilities)); os_zalloc(sizeof(struct rrm_enabled_capabilities));
if (rep->rrm_cap == NULL) if (rep->rrm_cap == NULL)
@ -424,6 +431,7 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID"); wpa_printf(MSG_DEBUG, "WNM: Too short multiple BSSID");
break; break;
} }
os_free(rep->mul_bssid);
rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid)); rep->mul_bssid = os_zalloc(sizeof(struct multiple_bssid));
if (rep->mul_bssid == NULL) if (rep->mul_bssid == NULL)
break; break;