A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 11:11:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix null pointer dereference in wma_fill_roam_synch_buffer

Browse source 
chan, a pointer to wmi_channel is derived from
param_buf->chan. param_buf->chan is derived from
WMI_ROAM_SYNCH_EVENTID_param_tlvs structure and
can be null. This may lead to null pointer dereference
when chan try to access the mhz field, chan->mhz.

Change-Id: I84ade344d2df3dfb5e35e7afaca3ddb768e22769
CRs-Fixed: 2385447
This commit is contained in:
Harprit Chhabada 2019-01-30 15:36:20 -08:00 • committed by nshrivas
commit 6420b58077
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/wma/src/wma_scan_roam.c
View file

@ -2261,7 +2261,8 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma,
}
chan = (wmi_channel *) param_buf->chan;
roam_synch_ind_ptr->chan_freq = chan->mhz;
if (chan)
roam_synch_ind_ptr->chan_freq = chan->mhz;
key = (wmi_key_material *) param_buf->key;
if (key != NULL) {
qdf_mem_copy(roam_synch_ind_ptr->kck, key->kck,