external/DAWN
1
0
Fork 0
mirror of https://github.com/berlin-open-wireless-lab/DAWN.git synced 2025-03-09 15:40:12 +00:00
Code Issues Releases Wiki Activity

ubus: avoid use after free in handle_probe_req()

Browse source 
Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
This commit is contained in:
Eneas U de Queiroz 2021-10-25 13:44:15 -03:00 • committed by Nick Hainke
parent e1275713c0
commit ddc007e32c
1 changed files with 6 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/utils/ubus.c
View file

@ -467,24 +467,20 @@ static int handle_probe_req(struct blob_attr *msg) {
if (probe_req != NULL) { if (probe_req != NULL) {
probe_req_updated = insert_to_array(probe_req, true, true, false, time(0)); probe_req_updated = insert_to_array(probe_req, true, true, false, time(0));
// If insert finds an existing entry, rather than linking in our new one,
// send new probe req because we want to stay synced.
// If not, probe_req and probe_req_updated should be equivalent
if (probe_req != probe_req_updated) if (probe_req != probe_req_updated)
{
// insert found an existing entry, rather than linking in our new one
// send new probe req because we want to stay synced
ubus_send_probe_via_network(probe_req_updated);
dawn_free(probe_req); dawn_free(probe_req);
}
else
ubus_send_probe_via_network(probe_req_updated); // probe_req and probe_req_updated should be equivalent
//send_blob_attr_via_network(msg, "probe"); ubus_send_probe_via_network(probe_req_updated);
if (!decide_function(probe_req, REQ_TYPE_PROBE)) { if (!decide_function(probe_req_updated, REQ_TYPE_PROBE)) {
return WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; // no reason needed... return WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; // no reason needed...
} }
} }
// TODO: Retrun for dawn_malloc() failure? // TODO: Return for dawn_malloc() failure?
return WLAN_STATUS_SUCCESS; return WLAN_STATUS_SUCCESS;
} }