summaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2013-11-30 18:17:55 +0100
committerFelix Fietkau <nbd@openwrt.org>2013-11-30 18:20:01 +0100
commit37769eb666aa614b76df9b537db35c2c70e3ac7a (patch)
tree41a8c4353175b51b656155a521c1ae9192284877
parente6cbe75a9a7cb424ca256c2769f3c7bb59332813 (diff)
wireless: fix use-after-free bug
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-rw-r--r--wireless.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/wireless.c b/wireless.c
index 23bedcc..daa4df7 100644
--- a/wireless.c
+++ b/wireless.c
@@ -495,6 +495,7 @@ vif_update(struct vlist_tree *tree, struct vlist_node *node_new,
wdev = vif_new->wdev;
if (vif_old && vif_new) {
+ vif_old->section = vif_new->section;
if (blob_attr_equal(vif_old->config, vif_new->config)) {
free(vif_new);
return;
@@ -505,7 +506,6 @@ vif_update(struct vlist_tree *tree, struct vlist_node *node_new,
vif_old->config = blob_memdup(vif_new->config);
wireless_interface_init_config(vif_old);
free(vif_new);
- vif_old->section = vif_new->section;
} else if (vif_new) {
D(WIRELESS, "Create new wireless interface %s on device %s\n", vif_new->name, wdev->name);
vif_new->config = blob_memdup(vif_new->config);