WNM: Fix deinit path to clean neighbor report count

wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing
the allocated buffer of neighbor reports. If this function was called
twice in a row without having went through new neighbor report parsing,
invalid pointers could have been freed resulted in segfault.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 952db0ac046ce3fbae2cc9749bae777bfa675b4e..1ca4c71faf77d2b16789d541250d05799b18ab5e 100644 (file)
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -319,6 +319,7 @@ void wnm_deallocate_memory(struct wpa_supplicant *wpa_s)
                os_free(wpa_s->wnm_neighbor_report_elements[i].mul_bssid);
        }
 
+       wpa_s->wnm_num_neighbor_report = 0;
        os_free(wpa_s->wnm_neighbor_report_elements);
        wpa_s->wnm_neighbor_report_elements = NULL;
 }