WNM: Fix possible memory leak by free buf

Buf is allocated and may not be freed on an error path.

Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>

diff --git a/src/ap/wnm_ap.c b/src/ap/wnm_ap.c
index 7e8fb5c6d8863f5df2e1fe9bfae150e7138929bf..4c8bc10083c4e7774b85273ffb9a304c2be55611 100644 (file)
--- a/src/ap/wnm_ap.c
+++ b/src/ap/wnm_ap.c
@@ -564,8 +564,11 @@ int wnm_send_bss_tm_req(struct hostapd_data *hapd, struct sta_info *sta,
        if (url) {
                /* Session Information URL */
                url_len = os_strlen(url);
-               if (url_len > 255)
+               if (url_len > 255) {
+                       os_free(buf);
                        return -1;
+               }
+
                *pos++ = url_len;
                os_memcpy(pos, url, url_len);
                pos += url_len;