From: Jouni Malinen <j@w1.fi>
Date: Sun, 3 Nov 2013 18:01:50 +0000 (+0200)
Subject: hostapd: Fix multi-BSS configuration file parsing regression
X-Git-Tag: hostap_2_1~643
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2fe210cebbb589179129af8bf7d0deed73789658;p=thirdparty%2Fhostap.git

hostapd: Fix multi-BSS configuration file parsing regression

Commit ebd79f07c47b02b71c0ac7744a6a94a2bae92fcf broke parsing of
configuration files that use the bss parameter to specify another BSS
entry. This resulted in crashing the process with NULL pointer
dereference since the new hostapd_config::bss design requires this
function to allocate a new hostapd_bss_config structure.

Signed-hostap: Jouni Malinen <j@w1.fi>
---

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 501aa4a51..ef0d647e6 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -762,16 +762,18 @@ static int hostapd_config_bss(struct hostapd_config *conf, const char *ifname)
 	}
 	conf->bss = all;
 
-	bss = conf->bss[conf->num_bss];
-	os_memset(bss, 0, sizeof(*bss));
+	bss = os_zalloc(sizeof(*bss));
+	if (bss == NULL)
+		return -1;
 	bss->radius = os_zalloc(sizeof(*bss->radius));
 	if (bss->radius == NULL) {
 		wpa_printf(MSG_ERROR, "Failed to allocate memory for "
 			   "multi-BSS RADIUS data");
+		os_free(bss);
 		return -1;
 	}
 
-	conf->num_bss++;
+	conf->bss[conf->num_bss++] = bss;
 	conf->last_bss = bss;
 
 	hostapd_config_defaults_bss(bss);