From: Eytan Lifshitz <eytan.lifshitz@intel.com>
Date: Mon, 10 Feb 2014 10:55:03 +0000 (+0200)
Subject: wpa_supplicant: Fix memory leak in wfd_subelems error path
X-Git-Tag: hostap_2_2~873
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5e6aa04b0995bc30b766e48d03eba81a4e2332d1;p=thirdparty%2Fhostap.git

wpa_supplicant: Fix memory leak in wfd_subelems error path

Memory allocated by calling function ieee802_11_vendor_ie_concat()
was not freed on an error path int ctrl_iface BSS command.

Signed-hostap: Eytan Lifshitz <eytan.lifshitz@intel.com>
---

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index ed332da88..663f40974 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -3504,8 +3504,10 @@ static int print_bss_info(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
 						  WFD_IE_VENDOR_TYPE);
 		if (wfd) {
 			ret = os_snprintf(pos, end - pos, "wfd_subelems=");
-			if (ret < 0 || ret >= end - pos)
+			if (ret < 0 || ret >= end - pos) {
+				wpabuf_free(wfd);
 				return 0;
+			}
 			pos += ret;
 
 			pos += wpa_snprintf_hex(pos, end - pos,