From be875fe3825ec0c9057f2a8ae8a5c85d38e65868 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Wed, 5 Sep 2018 12:17:03 +0200 Subject: [PATCH] wifi/iwd: in manager's interface_added() ensure known-network ID is not wrongly destroyed Calling g_hash_table_insert() with a key which is already hashed will destroy the *new* key. Since @id is used below, that would be use after free. Fixes: d635caf940551f8f5b52683b8379a1f81c58f8fc --- src/devices/wifi/nm-iwd-manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/devices/wifi/nm-iwd-manager.c b/src/devices/wifi/nm-iwd-manager.c index 7beb44e96a..8ff3b98452 100644 --- a/src/devices/wifi/nm-iwd-manager.c +++ b/src/devices/wifi/nm-iwd-manager.c @@ -494,7 +494,7 @@ interface_added (GDBusObjectManager *object_manager, GDBusObject *object, data = g_slice_new0 (KnownNetworkData); data->known_network = (GDBusProxy *) g_object_ref (proxy); - g_hash_table_insert (priv->known_networks, id, data); + g_hash_table_replace (priv->known_networks, id, data); if (security == NM_IWD_NETWORK_SECURITY_8021X) mirror_8021x_connection (self, id, data);