driver_ralink: Make sure assoc_{req,resp}_ies do not get double-freed

diff --git a/src/drivers/driver_ralink.c b/src/drivers/driver_ralink.c
index 27cae0b..6d99b3f 100644 (file)
--- a/src/drivers/driver_ralink.c
+++ b/src/drivers/driver_ralink.c
@@ -640,7 +640,7 @@ wpa_driver_ralink_event_wireless(struct wpa_driver_ralink_data *drv,
                                           "receive ASSOCINFO_EVENT !!!");
 
                                assoc_info_buf =
-                                       os_malloc(drv->assoc_req_ies_len +
+                                       os_zalloc(drv->assoc_req_ies_len +
                                                  drv->assoc_resp_ies_len + 1);
 
                                if (assoc_info_buf == NULL) {
@@ -652,18 +652,26 @@ wpa_driver_ralink_event_wireless(struct wpa_driver_ralink_data *drv,
                                        return;
                                }
 
-                               os_memcpy(assoc_info_buf, drv->assoc_req_ies,
-                                         drv->assoc_req_ies_len);
+                               if (drv->assoc_req_ies) {
+                                       os_memcpy(assoc_info_buf,
+                                                 drv->assoc_req_ies,
+                                                 drv->assoc_req_ies_len);
+                               }
                                info_pos = assoc_info_buf +
                                        drv->assoc_req_ies_len;
-                               os_memcpy(info_pos, drv->assoc_resp_ies,
-                                         drv->assoc_resp_ies_len);
+                               if (drv->assoc_resp_ies) {
+                                       os_memcpy(info_pos,
+                                                 drv->assoc_resp_ies,
+                                                 drv->assoc_resp_ies_len);
+                               }
                                assoc_info_buf[drv->assoc_req_ies_len +
                                               drv->assoc_resp_ies_len] = '\0';
                                wpa_driver_ralink_event_wireless_custom(
                                        drv, ctx, assoc_info_buf);
                                os_free(drv->assoc_req_ies);
+                               drv->assoc_req_ies = NULL;
                                os_free(drv->assoc_resp_ies);
+                               drv->assoc_resp_ies = NULL;
                                os_free(assoc_info_buf);
                        } else if (iwe->u.data.flags == RT_DISASSOC_EVENT_FLAG)
                        {