[PATCH] dhcp: clear c_gateway and c_prefixlen before remove

Before calling __connman_ipconfig_address_remove(), for specific
ipconfig->method cases, clear c_gateway and c_prefixlen to
prevent use-after-free.

Fixes: d593e995c7c7 ("dhcp: Remove old IP and gateway address")
---
 src/dhcp.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/dhcp.c b/src/dhcp.c
index 18dbab27151a..c84f1de410fb 100644
--- a/src/dhcp.c
+++ b/src/dhcp.c
@@ -471,9 +471,17 @@ static void lease_available_cb(GDHCPClient *dhcp_client, gpointer user_data)
 
 	DBG("c_address %s", c_address);
 
+	old_method = __connman_ipconfig_get_method(dhcp->ipconfig);
+
 	if (g_strcmp0(address, c_address)) {
 		ip_change = true;
 		if (c_address) {
+			if (old_method == CONNMAN_IPCONFIG_METHOD_AUTO ||
+			    old_method == CONNMAN_IPCONFIG_METHOD_DHCP) {
+				c_gateway = NULL;
+				c_prefixlen = 0;
+			}
+
 			/* Remove old ip address */
 			__connman_ipconfig_address_remove(dhcp->ipconfig);
 		}
@@ -487,7 +495,6 @@ static void lease_available_cb(GDHCPClient *dhcp_client, gpointer user_data)
 	} else if (prefixlen != c_prefixlen)
 		ip_change = true;
 
-	old_method = __connman_ipconfig_get_method(dhcp->ipconfig);
 	__connman_ipconfig_set_method(dhcp->ipconfig,
 						CONNMAN_IPCONFIG_METHOD_DHCP);
 
-- 
2.19.2