]> git.ipfire.org Git - thirdparty/hostap.git/commit
mka: Fix use-after-free when receive secure channels are deleted
authorDavide Caratti <davide.caratti@gmail.com>
Thu, 16 Mar 2017 13:01:54 +0000 (14:01 +0100)
committerJouni Malinen <j@w1.fi>
Sun, 26 Mar 2017 18:13:21 +0000 (21:13 +0300)
commit529d6ed7262f0015552e3b8f6eed8ea4508d7c1f
treeeece739df2f66585f261a41348a20c7e0f06c940
parentfaf0fef1dc1898b16d03b96aa2f39028f7faa528
mka: Fix use-after-free when receive secure channels are deleted

ieee802_1x_kay_deinit_receive_sc() frees the receive secure channel data,
but secy_delete_receive_sc() still needs it. Since these two functions
are always called sequentially, secy_delete_receive_sc() can be called
from ieee802_1x_kay_deinit_receive_sc() before rxsc is freed.

Fixes: 128f6a98b3d4 ("mka: Fix the order of operations in secure channel deletion")
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
src/pae/ieee802_1x_kay.c