From: Seung-Woo Kim <sw0312.kim@samsung.com>
Date: Tue, 24 May 2022 09:59:21 +0000 (+0900)
Subject: wispr: Prevent use-after-free from __connman_wispr_stop()
X-Git-Tag: accepted/tizen/unified/20220530.140608^0
X-Git-Url: http://review.tizen.org/git/?p=platform%2Fupstream%2Fconnman.git;a=commitdiff_plain;h=d208c619ca5d8585dd9bd55f3071a921ba253266

wispr: Prevent use-after-free from __connman_wispr_stop()

From __connman_wispr_stop(), list element wispr_portal freed by
g_hash_table_remove() is accessed. Prevent the use-after-free by
accessing the list element before free.

Change-Id: I17fdb38c1d9a0f8dd2980c33d3f78f319f504ed6
---

diff --git a/src/wispr.c b/src/wispr.c
index fb101a1..4674ae4 100755
--- a/src/wispr.c
+++ b/src/wispr.c
@@ -1047,17 +1047,11 @@ void __connman_wispr_stop(struct connman_service *service)
 	if (!wispr_portal)
 		return;
 
-	if (wispr_portal->ipv4_context) {
-		if (service == wispr_portal->ipv4_context->service)
-			g_hash_table_remove(wispr_portal_list,
-					GINT_TO_POINTER(index));
-	}
-
-	if (wispr_portal->ipv6_context) {
-		if (service == wispr_portal->ipv6_context->service)
-			g_hash_table_remove(wispr_portal_list,
-					GINT_TO_POINTER(index));
-	}
+	if ((wispr_portal->ipv4_context &&
+	     service == wispr_portal->ipv4_context->service) ||
+	    (wispr_portal->ipv6_context &&
+	     service == wispr_portal->ipv6_context->service))
+		g_hash_table_remove(wispr_portal_list, GINT_TO_POINTER(index));
 }
 
 int __connman_wispr_init(void)