WNM: Fix TM candidate freeing if multiple requests are processed

The previously cached candidate list needs to be free properly through a
call to wnm_deallocate_memory() to ensure all subelements gets freed.

Signed-off-by: Jouni Malinen <j@w1.fi>

wpa_supplicant/wnm_sta.c

@@ -745,8 +745,7 @@ static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
 		unsigned int valid_ms;
 
 		wpa_msg(wpa_s, MSG_INFO, "WNM: Preferred List Available");
-		wpa_s->wnm_num_neighbor_report = 0;
-		os_free(wpa_s->wnm_neighbor_report_elements);
+		wnm_deallocate_memory(wpa_s);
 		wpa_s->wnm_neighbor_report_elements = os_zalloc(
 			WNM_MAX_NEIGHBOR_REPORT *
 			sizeof(struct neighbor_report));