From 2b12f986bb4503ad39961ef53dc77c4d8f8553f3 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Thu, 23 Apr 2020 11:15:50 +0530 Subject: [PATCH] qcacmn: Fix NULL pointer dereference of roam stats event param buf In extract_roam_scan_ap_stats_tlv, if param buf is null, null pointer dereference can happen while trying to access num_roam_ap_info in the error message print. Return failure if param_buf is NULL Change-Id: I9f5cbb5534d1ef58bb9406ba8dc0aa68a9f8c194 CRs-Fixed: 2669350 --- wmi/src/wmi_unified_tlv.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 5021c5b87354..17447aad9da7 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -13056,9 +13056,14 @@ extract_roam_scan_ap_stats_tlv(wmi_unified_t wmi_handle, void *evt_buf, uint8_t i; param_buf = (WMI_ROAM_STATS_EVENTID_param_tlvs *)evt_buf; - if (!param_buf || ap_idx >= param_buf->num_roam_ap_info) { - WMI_LOGE("Invalid roam scan AP tlv ap_idx:%d total_ap:%d", - ap_idx, param_buf->num_roam_ap_info); + if (!param_buf) { + wmi_err("Param buf is NULL"); + return QDF_STATUS_E_FAILURE; + } + + if (ap_idx >= param_buf->num_roam_ap_info) { + wmi_err("Invalid roam scan AP tlv ap_idx:%d total_ap:%d", + ap_idx, param_buf->num_roam_ap_info); return QDF_STATUS_E_FAILURE; }