From: Jouni Malinen <j@w1.fi>
Date: Sun, 25 Nov 2018 11:51:26 +0000 (+0200)
Subject: DPP: Fix error path handling for GAS Comeback Response building
X-Git-Tag: hostap_2_7~65
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=11f07f027a7b91c06b87b4fe85432dae0c648486;p=thirdparty%2Fhostap.git

DPP: Fix error path handling for GAS Comeback Response building

A local memory allocation failuring during GAS Comeback Response frame
generation could result in freeing the response context without removing
it from the list. This would result in dereferencing freed memory when
processing the next comeback request.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/src/common/gas_server.c b/src/common/gas_server.c
index 492ee0041..ca46758ce 100644
--- a/src/common/gas_server.c
+++ b/src/common/gas_server.c
@@ -260,6 +260,7 @@ gas_server_handle_rx_comeback_req(struct gas_server_response *response)
 				       handler->adv_proto_id_len +
 				       resp_frag_len);
 	if (!resp) {
+		dl_list_del(&response->list);
 		gas_server_free_response(response);
 		return;
 	}