GAS: Fix double-free on an error path

[mech_eap.git] / wpa_supplicant / gas_query.c

diff --git a/wpa_supplicant/gas_query.c b/wpa_supplicant/gas_query.c
index c0c8c46..691de03 100644 (file)
--- a/wpa_supplicant/gas_query.c
+++ b/wpa_supplicant/gas_query.c
@@ -774,6 +774,7 @@ int gas_query_req(struct gas_query *gas, const u8 *dst, int freq,
 
        if (radio_add_work(gas->wpa_s, freq, "gas-query", 0, gas_query_start_cb,
                           query) < 0) {
+               query->req = NULL; /* caller will free this in error case */
                gas_query_free(query, 1);
                return -1;
        }