wifi: Stack based crash risk fixed

diff --git a/gsupplicant/supplicant.c b/gsupplicant/supplicant.c
index e7c9f88..cbbe95c 100644 (file)
--- a/gsupplicant/supplicant.c
+++ b/gsupplicant/supplicant.c
@@ -2149,6 +2149,7 @@ static void interface_select_network_result(const char *error,
 
        SUPPLICANT_DBG("");
 
+       g_free(data->ssid);
        dbus_free(data);
 }
 
@@ -2191,6 +2192,7 @@ static void interface_add_network_result(const char *error,
 error:
        g_free(interface->network_path);
        interface->network_path = NULL;
+       g_free(data->ssid);
        g_free(data);
 }
 

diff --git a/plugins/wifi.c b/plugins/wifi.c
index 62d9216..040d2f9 100644 (file)
--- a/plugins/wifi.c
+++ b/plugins/wifi.c
@@ -645,7 +645,7 @@ static int network_connect(struct connman_network *network)
        struct connman_device *device = connman_network_get_device(network);
        struct wifi_data *wifi;
        GSupplicantInterface *interface;
-       GSupplicantSSID ssid;
+       GSupplicantSSID *ssid;
 
        DBG("network %p", network);
 
@@ -656,16 +656,20 @@ static int network_connect(struct connman_network *network)
        if (wifi == NULL)
                return -ENODEV;
 
+       ssid = g_try_malloc0(sizeof(GSupplicantSSID));
+       if (ssid == NULL)
+               return -ENOMEM;
+
        interface = wifi->interface;
 
-       ssid_init(&ssid, network);
+       ssid_init(ssid, network);
 
        if (wifi->disconnecting == TRUE)
                wifi->pending_network = connman_network_ref(network);
        else {
                wifi->network = connman_network_ref(network);
 
-               return g_supplicant_interface_connect(interface, &ssid,
+               return g_supplicant_interface_connect(interface, ssid,
                                                connect_callback, NULL);
        }