[PATCH] wispr: Prevent use-after-free from __connman_wispr_stop()

[PATCH] wispr: Prevent use-after-free from __connman_wispr_stop()

[Seung-Woo Kim]

From __connman_wispr_stop(), list element wispr_portal freed by
g_hash_table_remove() is accessed. Prevent the use-after-free by
accessing the list element before free.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
---
 src/wispr.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/src/wispr.c b/src/wispr.c
index 22ecd937e1fe..7d4a3f54b24b 100644
--- a/src/wispr.c
+++ b/src/wispr.c
@@ -1038,17 +1038,11 @@ void __connman_wispr_stop(struct connman_service *service)
 	if (!wispr_portal)
 		return;
 
-	if (wispr_portal->ipv4_context) {
-		if (service == wispr_portal->ipv4_context->service)
-			g_hash_table_remove(wispr_portal_list,
-					GINT_TO_POINTER(index));
-	}
-
-	if (wispr_portal->ipv6_context) {
-		if (service == wispr_portal->ipv6_context->service)
-			g_hash_table_remove(wispr_portal_list,
-					GINT_TO_POINTER(index));
-	}
+	if ((wispr_portal->ipv4_context &&
+	     service == wispr_portal->ipv4_context->service) ||
+	    (wispr_portal->ipv6_context &&
+	     service == wispr_portal->ipv6_context->service))
+		g_hash_table_remove(wispr_portal_list, GINT_TO_POINTER(index));
 }
 
 int __connman_wispr_init(void)
-- 
2.19.2

Re: [PATCH] wispr: Prevent use-after-free from __connman_wispr_stop()

[Daniel Wagner]

On Tue, May 24, 2022 at 06:59:21PM +0900, Seung-Woo Kim wrote:
> From __connman_wispr_stop(), list element wispr_portal freed by
> g_hash_table_remove() is accessed. Prevent the use-after-free by
> accessing the list element before free.
> 
> Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

Good catch. Patch applied.

Thanks,
Daniel