DPP: Fix error path handling for GAS Comeback Response building

A local memory allocation failuring during GAS Comeback Response frame
generation could result in freeing the response context without removing
it from the list. This would result in dereferencing freed memory when
processing the next comeback request.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/common/gas_server.c b/src/common/gas_server.c
index 492ee0041a1774de9d4a447357dafe344057f3f7..ca46758cec7cd72437c1652efe9cf3228f7c46c6 100644 (file)
--- a/src/common/gas_server.c
+++ b/src/common/gas_server.c
@@ -260,6 +260,7 @@ gas_server_handle_rx_comeback_req(struct gas_server_response *response)
                                       handler->adv_proto_id_len +
                                       resp_frag_len);
        if (!resp) {
+               dl_list_del(&response->list);
                gas_server_free_response(response);
                return;
        }