diff options
| author | Seung-Woo Kim <sw0312.kim@samsung.com> | 2022-05-24 18:59:21 +0900 |
|---|---|---|
| committer | Daniel Wagner <wagi@monom.org> | 2022-05-25 09:14:08 +0200 |
| commit | 1e1d2af009efc8a8b65eccc06188bd6b28271af7 (patch) | |
| tree | 7036a22b854710e5ec413d0dff64602dc46cd668 | |
| parent | 4bf77e1c54e7926ea8dafa1060a439c2748300b9 (diff) | |
| download | connman-1e1d2af009efc8a8b65eccc06188bd6b28271af7.tar.gz | |
wispr: Prevent use-after-free from __connman_wispr_stop()
From __connman_wispr_stop(), list element wispr_portal freed by
g_hash_table_remove() is accessed. Prevent the use-after-free by
accessing the list element before free.
| -rw-r--r-- | src/wispr.c | 16 |
1 files changed, 5 insertions, 11 deletions
diff --git a/src/wispr.c b/src/wispr.c index 22ecd937..7d4a3f54 100644 --- a/src/wispr.c +++ b/src/wispr.c @@ -1038,17 +1038,11 @@ void __connman_wispr_stop(struct connman_service *service) if (!wispr_portal) return; - if (wispr_portal->ipv4_context) { - if (service == wispr_portal->ipv4_context->service) - g_hash_table_remove(wispr_portal_list, - GINT_TO_POINTER(index)); - } - - if (wispr_portal->ipv6_context) { - if (service == wispr_portal->ipv6_context->service) - g_hash_table_remove(wispr_portal_list, - GINT_TO_POINTER(index)); - } + if ((wispr_portal->ipv4_context && + service == wispr_portal->ipv4_context->service) || + (wispr_portal->ipv6_context && + service == wispr_portal->ipv6_context->service)) + g_hash_table_remove(wispr_portal_list, GINT_TO_POINTER(index)); } int __connman_wispr_init(void) |