dbus: Make sure ServiceDiscoveryRequest/Result does not override pointers

Explicitly free the previously allocated copy if ServiceDiscoveryRequest
or Service DiscvoveryResponse parsing loop finds multiple instances of
the same dict entry.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
index d001c0154794dfe0897c9900f189b4bcd9c64b0c..5d55ede5e3541c7ab0e9814edecf718a5c1becf8 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
@@ -2925,6 +2925,7 @@ DBusMessage * wpas_dbus_handler_p2p_service_sd_req(
                        if (entry.type != DBUS_TYPE_ARRAY ||
                            entry.array_type != DBUS_TYPE_BYTE)
                                goto error_clear;
+                       wpabuf_free(tlv);
                        tlv = wpabuf_alloc_copy(entry.bytearray_value,
                                                entry.array_len);
                } else
@@ -3011,6 +3012,7 @@ DBusMessage * wpas_dbus_handler_p2p_service_sd_res(
                        if (entry.type != DBUS_TYPE_ARRAY ||
                            entry.array_type != DBUS_TYPE_BYTE)
                                goto error_clear;
+                       wpabuf_free(tlv);
                        tlv = wpabuf_alloc_copy(entry.bytearray_value,
                                                entry.array_len);
                } else