From 5336f4036a3acc2509ba6750b6422e65f613b8e8 Mon Sep 17 00:00:00 2001 From: Vinod Kumar Myadam Date: Mon, 19 Feb 2024 14:29:13 +0530 Subject: [PATCH] qcacmn: Add check to avoid NULL pointer deference in parse MBSSID In malformed beacon frame may deference the NULL pointer while parsing MBSSID IE in util_scan_parse_mbssid will lead to crash. Add check in util_scan_parse_mbsssid for split_prof_start before passing to util_gen_new_ie and assign zero to split_prof_len whenever split_prof_start freed to avoid unanticipated scenario. Change-Id: Ibb9739d6b5d1775ab52d59f9aa5050ca693cd926 CRs-Fixed: 3717571 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 7ffe30b413d1..94a4a101a89d 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2524,6 +2524,8 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, } if (mbssid_info.split_prof_continue) { + if (!split_prof_start) + break; nontx_profile = split_prof_start; subie_len = split_prof_len; } else { @@ -2541,6 +2543,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, qdf_mem_free(split_prof_start); split_prof_start = NULL; split_prof_end = NULL; + split_prof_len = 0; } continue; } @@ -2606,6 +2609,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, qdf_mem_free(split_prof_start); split_prof_start = NULL; split_prof_end = NULL; + split_prof_len = 0; qdf_mem_zero(&mbssid_info, sizeof(mbssid_info)); } @@ -2620,6 +2624,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, qdf_mem_free(split_prof_start); split_prof_start = NULL; split_prof_end = NULL; + split_prof_len = 0; } qdf_mem_free(new_frame); }