From 6420b580770284ddd6855b8eca1bc7e0f0a21216 Mon Sep 17 00:00:00 2001 From: Harprit Chhabada Date: Wed, 30 Jan 2019 15:36:20 -0800 Subject: [PATCH] qcacld-3.0: Fix null pointer dereference in wma_fill_roam_synch_buffer chan, a pointer to wmi_channel is derived from param_buf->chan. param_buf->chan is derived from WMI_ROAM_SYNCH_EVENTID_param_tlvs structure and can be null. This may lead to null pointer dereference when chan try to access the mhz field, chan->mhz. Change-Id: I84ade344d2df3dfb5e35e7afaca3ddb768e22769 CRs-Fixed: 2385447 --- core/wma/src/wma_scan_roam.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index fed723902a4e..06ae58467177 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2261,7 +2261,8 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma, } chan = (wmi_channel *) param_buf->chan; - roam_synch_ind_ptr->chan_freq = chan->mhz; + if (chan) + roam_synch_ind_ptr->chan_freq = chan->mhz; key = (wmi_key_material *) param_buf->key; if (key != NULL) { qdf_mem_copy(roam_synch_ind_ptr->kck, key->kck,