WNM: Fix TM candidate freeing if multiple requests are processed

The previously cached candidate list needs to be free properly through a
call to wnm_deallocate_memory() to ensure all subelements gets freed.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 2ebdaf328e2845dcebf7b6ade824f5706afde24d..305231408c6d4285340490789c87e12a5fb8bcda 100644 (file)
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -745,8 +745,7 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
                unsigned int valid_ms;
 
                wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
-               wpa_s->wnm_num_neighbor_report = 0;
-               os_free(wpa_s->wnm_neighbor_report_elements);
+               wnm_deallocate_memory(wpa_s);
                wpa_s->wnm_neighbor_report_elements = os_zalloc(
                        WNM_MAX_NEIGHBOR_REPORT *
                        sizeof(struct neighbor_report));