tree 41fba9b8689a41c13c32a492043fd8e0c9075aaa
parent 03b5cdf515ae7259d67b33c22d829495ac80e631
author Jouni Malinen <jouni@qca.qualcomm.com> 1380286029 +0300
committer Dmitry Shmidt <dimitrysh@google.com> 1380302046 -0700

Fix possible freed-memory use in BSS table updates

If there are large number of BSSes in the scan results, BSS table update
could have added a BSS entry to the last_scan_res in a case where that
BSS entry got just deleted. This would happen only if there are more
than bss_max_count (by default 200) BSSes and if at least bss_max_count
of those BSSes are known (match a configured network). In such a case,
wpa_bss_add() could end up allocating a new BSS entry and return a
pointer to that entry even if it was the one that ended up getting freed
to keep the BSS table length within the limit. This could result in
freed memory being used and the process crashing (likely with segfault)
when trying to access information from that BSS entry.

Fix the issue by removing the oldest BSS entry before linking the new
entry to the table. This makes sure the newly added entry will never get
picked up as the one to be deleted immediately.

Bug: 10964663

Change-Id: I495dd2503127263746a69c9ef040c9e62fec0bda
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>