Nanako/openwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hostapd: get reference to object before removal

Browse Source 
`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.

To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.

Signed-off-by: Matthew Cather <mattbob4@gmail.com>
This commit is contained in:
Matthew Cather 2025-03-03 15:46:03 -06:00 committed by Felix Fietkau
parent 7729f96093
commit 6a10da2934
3 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/network/services/hostapd/src/src/ap/ucode.c
View File

@ -916,7 +916,7 @@ void hostapd_ucode_free(void)
void hostapd_ucode_free_iface(struct hostapd_iface *iface) void hostapd_ucode_free_iface(struct hostapd_iface *iface)
{ {
wpa_ucode_registry_remove(iface_registry, iface->ucode.idx); ucv_put(wpa_ucode_registry_remove(iface_registry, iface->ucode.idx));
} }
void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type) void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
@ -950,6 +950,8 @@ void hostapd_ucode_free_bss(struct hostapd_data *hapd)
uc_value_push(ucv_string_new(hapd->conf->iface)); uc_value_push(ucv_string_new(hapd->conf->iface));
uc_value_push(ucv_get(val)); uc_value_push(ucv_get(val));
ucv_put(wpa_ucode_call(2)); ucv_put(wpa_ucode_call(2));
ucv_put(val);
ucv_gc(vm); ucv_gc(vm);
} }

1
package/network/services/hostapd/src/src/utils/ucode.c
View File

@ -471,6 +471,7 @@ uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx)
if (!val) if (!val)
return NULL; return NULL;
ucv_get(val);
ucv_array_set(reg, idx - 1, NULL); ucv_array_set(reg, idx - 1, NULL);
dataptr = ucv_resource_dataptr(val, NULL); dataptr = ucv_resource_dataptr(val, NULL);
if (dataptr) if (dataptr)

1
package/network/services/hostapd/src/wpa_supplicant/ucode.c
View File

@ -70,6 +70,7 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s)
uc_value_push(ucv_string_new(wpa_s->ifname)); uc_value_push(ucv_string_new(wpa_s->ifname));
uc_value_push(ucv_get(val)); uc_value_push(ucv_get(val));
ucv_put(wpa_ucode_call(2)); ucv_put(wpa_ucode_call(2));
ucv_put(val);
ucv_gc(vm); ucv_gc(vm);
} }