From 2da3105ac1afc9fb931c4106d4007db6ba77c00a Mon Sep 17 00:00:00 2001 From: Michael Braun Date: Mon, 1 Mar 2021 23:27:46 +0200 Subject: [PATCH] Fix use after free with hapd->time_adv on interface restart When an interface is disabled, e.g. due to radar detected, hapd->time_adv is freed by hostapd_free_hapd_data(), but later used by ieee802_11_build_ap_params() calling hostapd_eid_time_adv(). Thus hapd->time_adv needs to be cleared as well. Fixes: 39b97072b2a4 ("Add support for Time Advertisement") Signed-off-by: Michael Braun --- src/ap/hostapd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c index 2f3e7878f..f06647c95 100644 --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c @@ -414,6 +414,7 @@ void hostapd_free_hapd_data(struct hostapd_data *hapd) } wpabuf_free(hapd->time_adv); + hapd->time_adv = NULL; #ifdef CONFIG_INTERWORKING gas_serv_deinit(hapd); -- 2.47.3