[PATCH] fix potential use-after-free in dbus byte array demarshaling code

Dan Williams dcbw
Tue Mar 4 07:04:04 PST 2008


The byte array code should be clearing its own pointer, not the string array pointer.

diff --git a/wpa_supplicant/dbus_dict_helpers.c b/wpa_supplicant/dbus_dict_helpers.c
index 1232ab2..d810979 100644
--- a/wpa_supplicant/dbus_dict_helpers.c
+++ b/wpa_supplicant/dbus_dict_helpers.c
@@ -674,7 +674,7 @@ static dbus_bool_t _wpa_dbus_dict_entry_get_byte_array(
 	/* Zero-length arrays are valid. */
 	if (entry->array_len == 0) {
 		free(entry->bytearray_value);
-		entry->strarray_value = NULL;
+		entry->bytearray_value = NULL;
 	}
 
 	success = TRUE;




More information about the Hostap mailing list