diff mbox

[2/5] wpa_supplicant: fix possible memory leak

Message ID 1434546996-7243-3-git-send-email-ilan.peer@intel.com
State Changes Requested
Headers show

Commit Message

Peer, Ilan June 17, 2015, 1:16 p.m. UTC 
From: Eytan Lifshitz <eytan.lifshitz@intel.com>

In wpa_config_read(), if the configuration file can't be opened,
some memory allocated by wpa_config_alloc_empty() won't be freed.

Signed-off-by: Eytan Lifshitz <eytan.lifshitz@intel.com>
---
 wpa_supplicant/config_file.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

Comments

Jouni Malinen June 18, 2015, 9:29 p.m. UTC | #1 
On Wed, Jun 17, 2015 at 04:16:33PM +0300, Ilan Peer wrote:
> In wpa_config_read(), if the configuration file can't be opened,
> some memory allocated by wpa_config_alloc_empty() won't be freed.

Could you please clarify what that "some memory" could be? The only
thing wpa_config_alloc_empty() allocates is the struct wpa_config
instance and the error path here frees that..
Peer, Ilan June 21, 2015, 1:14 p.m. UTC | #2 
> -----Original Message-----
> From: Jouni Malinen [mailto:j@w1.fi]
> Sent: Friday, June 19, 2015 00:30
> To: Peer, Ilan
> Cc: hostap@lists.shmoo.com; Eytan Lifshitz
> Subject: Re: [PATCH 2/5] wpa_supplicant: fix possible memory leak
> 
> On Wed, Jun 17, 2015 at 04:16:33PM +0300, Ilan Peer wrote:
> > In wpa_config_read(), if the configuration file can't be opened, some
> > memory allocated by wpa_config_alloc_empty() won't be freed.
> 
> Could you please clarify what that "some memory" could be? The only thing
> wpa_config_alloc_empty() allocates is the struct wpa_config instance and the
> error path here frees that..
> 
> --
> Jouni Malinen                                            PGP id EFC895FA

Sorry for this one ... please drop it.  

Regards,

Ilan.
diff mbox

Patch

diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
index e946567..00078c0 100644
--- a/wpa_supplicant/config_file.c
+++ b/wpa_supplicant/config_file.c
@@ -372,6 +372,16 @@  struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
 
 	if (name == NULL)
 		return NULL;
+
+	wpa_printf(MSG_DEBUG, "Reading configuration file '%s'", name);
+	f = fopen(name, "r");
+	if (f == NULL) {
+		wpa_printf(MSG_ERROR,
+			   "Failed to open config file '%s', error: %s",
+			   name, strerror(errno));
+		return NULL;
+	}
+
 	if (cfgp)
 		config = cfgp;
 	else
@@ -379,6 +389,7 @@  struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
 	if (config == NULL) {
 		wpa_printf(MSG_ERROR, "Failed to allocate config file "
 			   "structure");
+		fclose(f);
 		return NULL;
 	}
 	tail = head = config->ssid;
@@ -388,15 +399,6 @@  struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
 	while (cred_tail && cred_tail->next)
 		cred_tail = cred_tail->next;
 
-	wpa_printf(MSG_DEBUG, "Reading configuration file '%s'", name);
-	f = fopen(name, "r");
-	if (f == NULL) {
-		wpa_printf(MSG_ERROR, "Failed to open config file '%s', "
-			   "error: %s", name, strerror(errno));
-		os_free(config);
-		return NULL;
-	}
-
 	while (wpa_config_get_line(buf, sizeof(buf), f, &line, &pos)) {
 		if (os_strcmp(pos, "network={") == 0) {
 			ssid = wpa_config_read_network(f, &line, id++);