From 32354389fbd2d4cfcc8a6acd7511e26d45c102bf Mon Sep 17 00:00:00 2001 From: Sourav Mohapatra Date: Thu, 31 Oct 2019 14:22:48 +0530 Subject: [PATCH] qcacld-3.0: Add NULL check for heap allocations In function hdd_association_completion_handler, there are missing NULL checks for couple of heap allocated variables. This can lead to potential NULL pointer dereference. Add NULL pointer sanity check. Change-Id: I4343833b9e12da0012cfbff006bd8891e9bae025 CRs-Fixed: 2556755 --- core/hdd/src/wlan_hdd_assoc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index 7b4fb186a2a0..064c399c1222 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -3090,6 +3090,9 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, reqRsnIe = qdf_mem_malloc(sizeof(uint8_t) * DOT11F_IE_RSN_MAX_LEN); + if (!reqRsnIe) + return QDF_STATUS_E_NOMEM; + /* * For reassoc, the station is already registered, all we need * is to change the state of the STA in TL. @@ -3103,10 +3106,15 @@ hdd_association_completion_handler(struct hdd_adapter *adapter, u8 *assoc_req = NULL; unsigned int assoc_req_len = 0; struct ieee80211_channel *chan; + uint32_t rsp_rsn_lemgth = DOT11F_IE_RSN_MAX_LEN; uint8_t *rsp_rsn_ie = qdf_mem_malloc(sizeof(uint8_t) * DOT11F_IE_RSN_MAX_LEN); - uint32_t rsp_rsn_lemgth = DOT11F_IE_RSN_MAX_LEN; + if (!rsp_rsn_ie) { + qdf_mem_free(reqRsnIe); + return QDF_STATUS_E_NOMEM; + } + /* add bss_id to cfg80211 data base */ bss =