From: Jouni Malinen <j@w1.fi>
Date: Sat, 22 Nov 2014 15:28:04 +0000 (+0200)
Subject: WNM: Fix TM candidate freeing if multiple requests are processed
X-Git-Tag: hostap_2_4~1076
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=279b5486a6caad1d5eb69e7a39ebf846546d7d79;p=thirdparty%2Fhostap.git

WNM: Fix TM candidate freeing if multiple requests are processed

The previously cached candidate list needs to be free properly through a
call to wnm_deallocate_memory() to ensure all subelements gets freed.

Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 2ebdaf328..305231408 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -745,8 +745,7 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
 		unsigned int valid_ms;
 
 		wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
-		wpa_s->wnm_num_neighbor_report = 0;
-		os_free(wpa_s->wnm_neighbor_report_elements);
+		wnm_deallocate_memory(wpa_s);
 		wpa_s->wnm_neighbor_report_elements = os_zalloc(
 			WNM_MAX_NEIGHBOR_REPORT *
 			sizeof(struct neighbor_report));