From: Dan Williams <dcbw@redhat.com>
Date: Wed, 5 Mar 2008 14:15:10 +0000 (+0200)
Subject: Fix potential use-after-free in dbus byte array demarshaling code
X-Git-Tag: hostap_0_6_4~125
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf7a576f67fd814e4cd407c9828a72e5cf4b83c4;p=thirdparty%2Fhostap.git

Fix potential use-after-free in dbus byte array demarshaling code

The byte array code should be clearing its own pointer, not the string
array pointer.
---

diff --git a/wpa_supplicant/dbus_dict_helpers.c b/wpa_supplicant/dbus_dict_helpers.c
index 1232ab29c..d81097914 100644
--- a/wpa_supplicant/dbus_dict_helpers.c
+++ b/wpa_supplicant/dbus_dict_helpers.c
@@ -674,7 +674,7 @@ static dbus_bool_t _wpa_dbus_dict_entry_get_byte_array(
 	/* Zero-length arrays are valid. */
 	if (entry->array_len == 0) {
 		free(entry->bytearray_value);
-		entry->strarray_value = NULL;
+		entry->bytearray_value = NULL;
 	}
 
 	success = TRUE;