RRM: Fix a memory leak in beacon request handling

Free the pending frequency list if a second beacon request is received
before the scan for the previous one has been completed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/wpa_supplicant/rrm.c b/wpa_supplicant/rrm.c
index 36a8336e7a88987061ce19096440e42476df824e..5be917c8a1f162811b698ba88936f85e5dc9e1ef 100644 (file)
--- a/wpa_supplicant/rrm.c
+++ b/wpa_supplicant/rrm.c
@@ -1032,6 +1032,7 @@ wpas_rm_handle_beacon_req(struct wpa_supplicant *wpa_s,
        elems_len = len - sizeof(*req);
        rand_interval = le_to_host16(req->rand_interval);
 
+       os_free(params->freqs);
        os_memset(params, 0, sizeof(*params));
 
        data->token = elem_token;