hostapd: get reference to object before removal

`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.

To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit 6a10da2934441a59283394a84917edf4983e3043)

diff --git a/package/network/services/hostapd/src/src/ap/ucode.c b/package/network/services/hostapd/src/src/ap/ucode.c
index 0e9a4fef119b65d44353651aa7eb3f588010a63d..26ecc6ad30967657128b15b88d87003f0240cd57 100644 (file)
--- a/package/network/services/hostapd/src/src/ap/ucode.c
+++ b/package/network/services/hostapd/src/src/ap/ucode.c
@@ -876,7 +876,7 @@ void hostapd_ucode_free(void)
 
 void hostapd_ucode_free_iface(struct hostapd_iface *iface)
 {
-       wpa_ucode_registry_remove(iface_registry, iface->ucode.idx);
+       ucv_put(wpa_ucode_registry_remove(iface_registry, iface->ucode.idx));
 }
 
 void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
@@ -910,6 +910,8 @@ void hostapd_ucode_free_bss(struct hostapd_data *hapd)
        uc_value_push(ucv_string_new(hapd->conf->iface));
        uc_value_push(ucv_get(val));
        ucv_put(wpa_ucode_call(2));
+
+       ucv_put(val);
        ucv_gc(vm);
 }
 

diff --git a/package/network/services/hostapd/src/src/utils/ucode.c b/package/network/services/hostapd/src/src/utils/ucode.c
index e61cb18db0bb1fc0dfdb08b4cc189da06e83ac0c..7636e46aaf2894f2e46b8ae6a23c1d37b80b86a4 100644 (file)
--- a/package/network/services/hostapd/src/src/utils/ucode.c
+++ b/package/network/services/hostapd/src/src/utils/ucode.c
@@ -470,6 +470,7 @@ uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx)
        if (!val)
                return NULL;
 
+       ucv_get(val);
        ucv_array_set(reg, idx - 1, NULL);
        dataptr = ucv_resource_dataptr(val, NULL);
        if (dataptr)

diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.c b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
index 506bde45c93d06ae397c7d7acd4ddb9815d09e4d..8335a27e892b88ad9226fefe9a87739e0eccae3d 100644 (file)
--- a/package/network/services/hostapd/src/wpa_supplicant/ucode.c
+++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
@@ -70,6 +70,7 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s)
        uc_value_push(ucv_string_new(wpa_s->ifname));
        uc_value_push(ucv_get(val));
        ucv_put(wpa_ucode_call(2));
+       ucv_put(val);
        ucv_gc(vm);
 }