Fix potential double free and use of freed memory in RADIUS client

ieee802_1x_encapsulate_radius() frees the RADIUS message if
radius_client_send() returns error. This could have resulted in use of
freed memory and double freeing of the RADIUS message if send() fails
since the message is also left in the retransmit list. Avoid this by not
returning error to the caller in such a case.

Signed-off-by: Alexander Couzens <lynxis@c-base.org>

diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
index bcd471b7e4d4ed4113663c545efee707d6453aaf..cdaeae9b8e5e62d8a00ed3578140c045c1219bab 100644 (file)
--- a/src/radius/radius_client.c
+++ b/src/radius/radius_client.c
@@ -678,7 +678,7 @@ int radius_client_send(struct radius_client_data *radius,
        radius_client_list_add(radius, msg, msg_type, shared_secret,
                               shared_secret_len, addr);
 
-       return res;
+       return 0;
 }