Fix for Double free corruption during WiFi disconnect.
This issue is easily reproduced after a disconnect and a connect to WiFi. On
disconnect, __connman_tethering_update_interface is called which will free
default_interface but since interface is null during disconnect, no strdup is
done. Now on connect, __connman_tethering_update_interface is called which will
also try to free the default_interface which was already freed during
disconnect and hence the issue.
If interface is NULL, making default_interface also NULL will fix the issue.
---
src/tethering.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/src/tethering.c b/src/tethering.c
index 8cbee09..c5e957d 100644
--- a/src/tethering.c
+++ b/src/tethering.c
@@ -331,6 +331,7 @@ void __connman_tethering_update_interface(const char
*interface)
if (interface == NULL) {
disable_nat(interface);
+ default_interface = NULL;
return;
}
---
_______________________________________________
connman mailing list
[email protected]
http://lists.connman.net/listinfo/connman
