D-Bus: Fix memory leak on P2P GO WPSVendorExtensions

It was possible to add WPS vendor extensions through the D-Bus
WPSVendorExtensions setter, but these extensions were not freed when the
P2P GO was stopped or when replacing previously configured extensions.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 5bc468a08fd993473e73c5465241b6d2c7b92a1d..1c0ed7aa938f0453ce944ca9dae5926667dddb1b 100644 (file)
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -496,6 +496,12 @@ void hostapd_config_free_bss(struct hostapd_bss_config *conf)
        os_free(conf->model_description);
        os_free(conf->model_url);
        os_free(conf->upc);
+       {
+               unsigned int i;
+
+               for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
+                       wpabuf_free(conf->wps_vendor_ext[i]);
+       }
        wpabuf_free(conf->wps_nfc_dh_pubkey);
        wpabuf_free(conf->wps_nfc_dh_privkey);
        wpabuf_free(conf->wps_nfc_dev_pw);

diff --git a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
index f006887036e6ab2a00f0192c659ad16a5310d39b..8ba2816aefd5505f4618313b3efb9c16a75d648c 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
@@ -2223,6 +2223,7 @@ dbus_bool_t wpas_dbus_setter_p2p_group_vendor_ext(DBusMessageIter *iter,
                                goto error;
 
                        for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) {
+                               wpabuf_free(hapd->conf->wps_vendor_ext[i]);
                                if (i < entry.array_len) {
                                        hapd->conf->wps_vendor_ext[i] =
                                                entry.binarray_value[i];