From 34c5877b8dcd2de90767da035532d0549219cf13 Mon Sep 17 00:00:00 2001 From: Aditya Sathish Date: Tue, 7 Jul 2020 14:19:39 +0530 Subject: [PATCH] qcacmn: Add NULL check for find IE API Ensure that the IE pointer is not dereferenced if the pointer passed to the function is NULL. CRs-Fixed: 2724504 Change-Id: Ie6b4c633e252de5162c9f7ab72c2ea4a2cc058dd --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 859630d0c03d..ff907336738c 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -1651,13 +1651,15 @@ util_scan_gen_scan_entry(struct wlan_objmgr_pdev *pdev, * @ies: pointer consisting of IEs * @len: IE length * - * Return: NULL if the element ID is not found or - * a pointer to the first byte of the requested - * element + * Return: NULL if the element ID is not found or if IE pointer is NULL else + * pointer to the first byte of the requested element */ static uint8_t *util_scan_find_ie(uint8_t eid, uint8_t *ies, int32_t len) { + if (!ies) + return NULL; + while (len >= 2 && len >= ies[1] + 2) { if (ies[0] == eid) return ies;