wpa_supplicant: Fix parsing errors on additional config file

If the -I<config> argument is used and the referenced configuration file
cannot be parsed, wpa_config_read() ended up freeing the main
configuration data structure and that resulted in use of freed memory in
such an error case. Fix this by not freeing the main config data and
handling the error case in the caller.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index bf0ba173c3e0bd1fec21332c716c25245ebf108a..aaee97e9020ef71314326b2cec12bbd4619abdf1 100644 (file)
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -464,7 +464,8 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
 
 #ifndef WPA_IGNORE_CONFIG_ERRORS
        if (errors) {
-               wpa_config_free(config);
+               if (config != cfgp)
+                       wpa_config_free(config);
                config = NULL;
                head = NULL;
        }

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 8bc9a7c587d7d10f67bc6d76b23f264716328ee3..c35121ec3cd0d65f4355ab1893560fafe7473869 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1010,7 +1010,13 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
                        "file '%s' - exiting", wpa_s->confname);
                return -1;
        }
-       wpa_config_read(wpa_s->confanother, conf);
+       if (wpa_s->confanother &&
+           !wpa_config_read(wpa_s->confanother, conf)) {
+               wpa_msg(wpa_s, MSG_ERROR,
+                       "Failed to parse the configuration file '%s' - exiting",
+                       wpa_s->confanother);
+               return -1;
+       }
 
        conf->changed_parameters = (unsigned int) -1;
 
@@ -5219,7 +5225,13 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
                        return -1;
                }
                wpa_s->confanother = os_rel2abs_path(iface->confanother);
-               wpa_config_read(wpa_s->confanother, wpa_s->conf);
+               if (wpa_s->confanother &&
+                   !wpa_config_read(wpa_s->confanother, wpa_s->conf)) {
+                       wpa_printf(MSG_ERROR,
+                                  "Failed to read or parse configuration '%s'.",
+                                  wpa_s->confanother);
+                       return -1;
+               }
 
                /*
                 * Override ctrl_interface and driver_param if set on command