Fix derefrencing of invalid pointersubmit/tizen/20220617.053331accepted/tizen/unified/20220620.131713

Change-Id: I1414eb584a0644423aef07511f68c0be4b63c911
Signed-off-by: Jaehyun Kim <jeik01.kim@samsung.com>

4 files changed, 44 insertions, 3 deletions

diff --git a/gsupplicant/gsupplicant.h b/gsupplicant/gsupplicant.h
index 0823a394..ed07c1f6 100755
--- a/gsupplicant/gsupplicant.h
+++ b/gsupplicant/gsupplicant.h
@@ -540,6 +540,7 @@ void g_supplicant_network_update_assoc_reject(GSupplicantInterface *interface,
 GHashTable *g_supplicant_network_get_assoc_reject_table(GSupplicantNetwork *network);
 GSupplicantNetwork *g_supplicant_interface_get_network(GSupplicantInterface *interface,
 		const char *group);
+GHashTable *g_supplicant_network_clone_assoc_reject_table(GSupplicantNetwork *network);
 #endif
 
 #if defined TIZEN_EXT && defined TIZEN_EXT_EAP_ON_ETHERNET
diff --git a/gsupplicant/supplicant.c b/gsupplicant/supplicant.c
index 5d1eb8f8..4bc52762 100755
--- a/gsupplicant/supplicant.c
+++ b/gsupplicant/supplicant.c
@@ -2315,6 +2315,43 @@ GSupplicantNetwork *g_supplicant_interface_get_network(GSupplicantInterface *int
 
 	return g_hash_table_lookup(interface->network_table, group);
 }
+
+static void copy_assoc_reject(gpointer key, gpointer value, gpointer user_data)
+{
+	struct assoc_reject_data *cloned_assoc_data;
+	struct assoc_reject_data *assoc_data = value;
+	GHashTable *cloned_assoc_reject_table = user_data;
+
+	if (assoc_data && cloned_assoc_reject_table) {
+		cloned_assoc_data = g_try_new0(struct assoc_reject_data, 1);
+		if (!cloned_assoc_data)
+			return;
+
+		cloned_assoc_data->bssid = g_strdup(assoc_data->bssid);
+		cloned_assoc_data->reject_time_list = g_slist_copy(assoc_data->reject_time_list);
+		g_hash_table_insert(cloned_assoc_reject_table,
+					cloned_assoc_data->bssid, cloned_assoc_data);
+	}
+}
+
+GHashTable *g_supplicant_network_clone_assoc_reject_table(GSupplicantNetwork *network)
+{
+	GHashTable *cloned_assoc_reject_table;
+
+	if (!network)
+		return NULL;
+
+	GHashTable *assoc_reject_table = g_supplicant_network_get_assoc_reject_table(network);
+	if (!assoc_reject_table)
+		return NULL;
+
+	cloned_assoc_reject_table = g_hash_table_new_full(g_str_hash, g_str_equal,
+								NULL, remove_assoc_data);
+	g_hash_table_foreach(assoc_reject_table, copy_assoc_reject, cloned_assoc_reject_table);
+
+	return cloned_assoc_reject_table;
+}
+
 #endif
 
 static void merge_network(GSupplicantNetwork *network)
diff --git a/plugins/wifi.c b/plugins/wifi.c
index 41b8925e..9bd11cb4 100755
--- a/plugins/wifi.c
+++ b/plugins/wifi.c
@@ -4732,7 +4732,7 @@ static void interface_state(GSupplicantInterface *interface)
 				supplicant_network = g_supplicant_interface_get_network(interface, group);
 
 				connman_network_set_assoc_reject_table(network,
-					g_supplicant_network_get_assoc_reject_table(supplicant_network));
+						g_supplicant_network_clone_assoc_reject_table(supplicant_network));
 
 				g_supplicant_network_update_assoc_reject(interface, supplicant_network);
 			}
@@ -5383,7 +5383,7 @@ static void network_added(GSupplicantNetwork *supplicant_network)
 	connman_network_set_last_connected_bssid(network,
 			g_supplicant_network_get_last_connected_bssid(supplicant_network));
 	connman_network_set_assoc_reject_table(network,
-			g_supplicant_network_get_assoc_reject_table(supplicant_network));
+			g_supplicant_network_clone_assoc_reject_table(supplicant_network));
 #endif
 	connman_network_set_available(network, true);
 	connman_network_set_string(network, "WiFi.Mode", mode);
@@ -5588,7 +5588,7 @@ static void network_changed(GSupplicantNetwork *network, const char *property)
 #if defined TIZEN_EXT
 	else if (g_str_equal(property, "UpdateAssocReject")) {
 		connman_network_set_assoc_reject_table(connman_network,
-					g_supplicant_network_get_assoc_reject_table(network));
+				g_supplicant_network_clone_assoc_reject_table(network));
 		update_needed = true;
 	}
 #endif
diff --git a/src/network.c b/src/network.c
index 70461370..3bf62992 100755
--- a/src/network.c
+++ b/src/network.c
@@ -1350,6 +1350,7 @@ static void network_destruct(struct connman_network *network)
 #if defined TIZEN_EXT
 	g_slist_free_full(network->wifi.vsie_list, g_free);
 	g_slist_free_full(network->wifi.bssid_list, g_free);
+	g_hash_table_destroy(network->wifi.assoc_reject_table);
 #endif
 	g_free(network->path);
 	g_free(network->group);
@@ -2668,6 +2669,8 @@ void connman_network_set_assoc_reject_table(struct connman_network *network,
 	if (!assoc_reject_table)
 		return;
 
+	g_hash_table_destroy(network->wifi.assoc_reject_table);
+
 	network->wifi.assoc_reject_table = assoc_reject_table;
 }