Fix TLS in/out buffer freeing

The previous version could end leaking memory since os_free() was used
instead of wpabuf_free(). In addition, this could potentially have
triggered a crash if the TLS context were being freed when pending
input data where still in the buffer (though, this may not be possible
to trigger in practice).

diff --git a/src/eap_server/eap_tls_common.c b/src/eap_server/eap_tls_common.c
index fcf665443645612467a192bede6074ed204e86f7..25ae683f06688c93faa937dc959d8ad5bef9e5c4 100644 (file)
--- a/src/eap_server/eap_tls_common.c
+++ b/src/eap_server/eap_tls_common.c
@@ -21,6 +21,9 @@
 #include "eap_tls_common.h"
 
 
+static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
+
+
 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
                            int verify_peer)
 {
@@ -58,8 +61,9 @@ int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
 {
        tls_connection_deinit(sm->ssl_ctx, data->conn);
-       os_free(data->tls_in);
-       os_free(data->tls_out);
+       eap_server_tls_free_in_buf(data);
+       wpabuf_free(data->tls_out);
+       data->tls_out = NULL;
 }