From 9ea7470dde4fdfc578c96b81e21d4cdac56055f3 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Mon, 27 Jun 2016 15:24:29 -0700 Subject: [PATCH] qcacld-3.0: Fix NULL pointer dereference in __lim_process_sme_join_req In function __lim_process_sme_join_req, access session id and transaction id from msg_buff instead of sme_join_req which could be null at the point of access. Change-Id: I299b87f6144d0b6452d49ebc9d8ed28ff417723c CRs-Fixed: 1034255 --- core/mac/src/pe/lim/lim_process_sme_req_messages.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 8893d50e60f2..1f7364ee4837 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -2066,8 +2066,8 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf) } end: - sme_session_id = sme_join_req->sessionId; - sme_transaction_id = sme_join_req->transactionId; + sme_session_id = ((tpSirSmeJoinReq)msg_buf)->sessionId; + sme_transaction_id = ((tpSirSmeJoinReq)msg_buf)->transactionId; if (sme_join_req) { qdf_mem_free(sme_join_req);