Fix a memory leak in WPS with ap_scan=2

The wpa_ie buffer is now allocated here and needs to be freed before
returning from the function.

Fixes: d2ba0d719e2a ("Move assoc param setting into a helper function")
Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 40068984bbcea82a1734d8d06bc493a85784146a..6a02ed7c561fe174012cb68266be906a45bf4416 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -3559,6 +3559,7 @@ static void wpas_start_assoc_cb(struct wpa_radio_work *work, int deinit)
                wpa_s->scan_req = MANUAL_SCAN_REQ;
                wpa_s->reassociate = 1;
                wpa_supplicant_req_scan(wpa_s, 0, 0);
+               os_free(wpa_ie);
                return;
 #endif /* CONFIG_WPS */
        } else {