dbus: Fix a potential double-free in on error path (CID 62880)

It would have been at least theoretically possible to hit the first
error in the loop and end up jumping to error handling which would call
os_free(value) without the value having been cleared after the os_free()
call at the end of the previous loop iteration.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index 6e1eedb129eae6d1242db7847adfb159c9c00c97..27190c6f0525a7c3da9c48b3db152b86ba6dd815 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -271,6 +271,7 @@ dbus_bool_t set_network_properties(struct wpa_supplicant *wpa_s,
                        wpa_config_update_prio_list(wpa_s->conf);
 
                os_free(value);
+               value = NULL;
                wpa_dbus_dict_entry_clear(&entry);
        }