commit cfad788eb8f4bdaf91888562fff6c624b960f534 Author: Michael Braun Date: Mon Mar 1 23:27:46 2021 Fix use after free with hapd->time_adv When an interface is disabled, e.g. due to radar detected, hapd->time_adv is freed by hostapd_free_hapd_data, but later used by ieee802_11_build_ap_params calling hostapd_eid_time_adv. Thus hapd->time_adv needs to be cleared as well. Signed-off-by: Michael Braun Fixes: 39b97072b2 diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c index e25717464..b4364277e 100644 --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c @@ -414,6 +414,7 @@ void hostapd_free_hapd_data(struct hostapd_data *hapd) } wpabuf_free(hapd->time_adv); + hapd->time_adv = NULL; #ifdef CONFIG_INTERWORKING gas_serv_deinit(hapd);