A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix NULL pointer dereference in csr_roam_join_next_bss

Browse source 
Add NULL pointer check for "result" after call to csr_roam_select_bss.
This function can return a NULL value for variable "result", which is
later dereference in the function csr_roam_join_handle_profile.

Change-Id: I5e1f017de49301a14b899692b888f7694e979bf1
CRs-Fixed: 1027725
This commit is contained in:
Naveen Rawat 2016-06-15 11:07:24 -07:00 • committed by Nandini Suresh
commit a395d25d53
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/sme/src/csr/csr_api_roam.c
View file

@ -5266,8 +5266,15 @@ static eCsrJoinState csr_roam_join_next_bss(tpAniSirGlobal mac_ctx,
if (!roam_info_ptr)
roam_info_ptr = &roam_info;
roam_info_ptr->u.pConnectedProfile = &session->connectedProfile;
csr_roam_join_handle_profile(mac_ctx, session_id, cmd, roam_info_ptr,
&roam_state, result, scan_result);
/*
* result will be null if passed pRoamBssEntry is NULL, which
* indicates we are done with all BSSs in list.
*/
if (result != NULL)
csr_roam_join_handle_profile(mac_ctx, session_id, cmd,
roam_info_ptr, &roam_state,
result, scan_result);
end:
if ((eCsrStopRoaming == roam_state) && CSR_IS_INFRASTRUCTURE(profile) &&
(session->bRefAssocStartCnt > 0)) {