hostapd: Fix multi-BSS configuration file parsing regression

Commit ebd79f07c47b02b71c0ac7744a6a94a2bae92fcf broke parsing of
configuration files that use the bss parameter to specify another BSS
entry. This resulted in crashing the process with NULL pointer
dereference since the new hostapd_config::bss design requires this
function to allocate a new hostapd_bss_config structure.

Signed-hostap: Jouni Malinen <j@w1.fi>

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 501aa4a51492b4a1fc7fbdd4c2eb25fc497e503b..ef0d647e68aac54fa0fdae8bfe4541fc4f4ac1b9 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -762,16 +762,18 @@ static int hostapd_config_bss(struct hostapd_config *conf, const char *ifname)
        }
        conf->bss = all;
 
-       bss = conf->bss[conf->num_bss];
-       os_memset(bss, 0, sizeof(*bss));
+       bss = os_zalloc(sizeof(*bss));
+       if (bss == NULL)
+               return -1;
        bss->radius = os_zalloc(sizeof(*bss->radius));
        if (bss->radius == NULL) {
                wpa_printf(MSG_ERROR, "Failed to allocate memory for "
                           "multi-BSS RADIUS data");
+               os_free(bss);
                return -1;
        }
 
-       conf->num_bss++;
+       conf->bss[conf->num_bss++] = bss;
        conf->last_bss = bss;
 
        hostapd_config_defaults_bss(bss);