CVE-2023-41102

An attacker can repeatedly connect and disconnect from the captive portal, triggering client_reset() and _client_list_free_node() on the OpenNDS gateway [ref_id=1]. Each cycle leaks memory because fields such as token, hid, custom, client_type, cid, and cpi_query are not freed before the client struct is reused or deallocated [ref_id=1]. Over time, the accumulated leaks exhaust all available memory on the gateway, leading to a Denial-of-Service condition. No authentication is required; the attacker only needs network access to the captive portal interface.

The functions client_reset() and _client_list_free_node() in the OpenNDS captive portal code are affected [ref_id=1]. In client_reset(), the cpi_query field was not allocated before use. In _client_list_free_node(), the fields token, hid, custom, client_type, cid, and cpi_query were not freed before the client struct was freed [ref_id=1].

The patch adds missing free() calls for client->token, client->hid, client->custom, client->client_type, and client->cid inside _client_list_free_node() [ref_id=1]. It also moves the client->cid allocation inside the if-block so it is only called when cid was not previously set, and adds a conditional allocation for client->cpi_query in client_reset() to prevent a NULL-pointer dereference [ref_id=1]. These changes ensure all dynamically allocated memory is properly released when a client entry is freed or reset, closing the memory leaks.