aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
diff options
context:
space:
mode:
authorDavid Bauer <mail@david-bauer.net>2021-11-17 21:46:11 +0100
committerDavid Bauer <mail@david-bauer.net>2021-11-19 21:58:12 +0100
commit7ae04d3799d44b4a9fd3a2c82763d202be97fb77 (patch)
treed3cb415a486271525cb60d5ef5d9ea2684347c5c /package/network
parentea5fce3f4616df3e4331e6b4e8e79767bded442c (diff)
downloadupstream-7ae04d3799d44b4a9fd3a2c82763d202be97fb77.tar.gz
upstream-7ae04d3799d44b4a9fd3a2c82763d202be97fb77.tar.bz2
upstream-7ae04d3799d44b4a9fd3a2c82763d202be97fb77.zip
hostapd: fix use after free bugs
Using a pointer one lifter after it freed is not the best idea. Let's not do that. Signed-off-by: David Bauer <mail@david-bauer.net>
Diffstat (limited to 'package/network')
-rw-r--r--package/network/services/hostapd/patches/600-ubus_support.patch12
1 files changed, 6 insertions, 6 deletions
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index ccf66be6b8..b7f156bceb 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -234,22 +234,22 @@
wpabuf_free(sta->p2p_ie);
--- a/src/ap/sta_info.c
+++ b/src/ap/sta_info.c
-@@ -459,6 +459,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+@@ -458,6 +458,7 @@ void ap_handle_timer(void *eloop_ctx, vo
+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "deauthenticated due to "
"local deauth request");
- ap_free_sta(hapd, sta);
+ hostapd_ubus_notify(hapd, "local-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
return;
}
-
-@@ -614,6 +615,7 @@ skip_poll:
+@@ -613,6 +614,7 @@ skip_poll:
+ mlme_deauthenticate_indication(
hapd, sta,
WLAN_REASON_PREV_AUTH_NOT_VALID);
- ap_free_sta(hapd, sta);
+ hostapd_ubus_notify(hapd, "inactive-deauth", sta->addr);
+ ap_free_sta(hapd, sta);
break;
}
- }
@@ -1329,6 +1331,7 @@ void ap_sta_set_authorized(struct hostap
buf, ip_addr, keyid_buf);
} else {