From f902444325944f324e8c9b37d6d00f2603b52547 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20Klime=C5=A1?= <jklimes@redhat.com>
Date: Mon, 16 Nov 2015 11:00:42 +0100
Subject: [PATCH] ifcfg: fix a possible double-free error on invalid WEP key
 (rh #1281324)

https://bugzilla.redhat.com/show_bug.cgi?id=1281324
---
 src/settings/plugins/ifcfg-rh/writer.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/src/settings/plugins/ifcfg-rh/writer.c b/src/settings/plugins/ifcfg-rh/writer.c
index ca45721934..aaf0ebe906 100644
--- a/src/settings/plugins/ifcfg-rh/writer.c
+++ b/src/settings/plugins/ifcfg-rh/writer.c
@@ -713,15 +713,19 @@ write_wireless_security_setting (NMConnection *connection,
 						ascii_key = g_strdup_printf ("s:%s", key);
 						key = ascii_key;
 					}
-				} else
-					key = NULL;
+				} else {
+					nm_log_warn (LOGD_SETTINGS, "    invalid WEP key '%s'", key);
+					tmp = NULL;
+				}
 
-				set_secret (ifcfg,
-				            tmp,
-				            key,
-				            "WEP_KEY_FLAGS",
-				            nm_setting_wireless_security_get_wep_key_flags (s_wsec),
-				            FALSE);
+				if (tmp) {
+					set_secret (ifcfg,
+					            tmp,
+					            key,
+					            "WEP_KEY_FLAGS",
+					            nm_setting_wireless_security_get_wep_key_flags (s_wsec),
+					            FALSE);
+				}
 				g_free (tmp);
 				g_free (ascii_key);
 			}