A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix NULL pointer dereference

Browse source 
In extract_hal_reg_cap_tlv(), hal_reg_capabilities
can be optionally defined. This field can be NULL
resulting in a NULL pointer read. Add NULL pointer
check before qdf_memory_call().

Change-Id: I142bed65e80aa9b4bb88a4e68f74235dd50e3624
CRs-Fixed: 2368284
This commit is contained in:
tinlin 2018-12-20 17:02:17 +08:00 • committed by nshrivas
commit ab5cba5cbb
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
wmi/src/wmi_unified_tlv.c
View file

@ -8119,7 +8119,10 @@ static QDF_STATUS extract_hal_reg_cap_tlv(wmi_unified_t wmi_handle,
WMI_SERVICE_READY_EVENTID_param_tlvs *param_buf;
param_buf = (WMI_SERVICE_READY_EVENTID_param_tlvs *) evt_buf;
if (!param_buf) {
WMI_LOGE("%s: Invalid arguments", __func__);
return QDF_STATUS_E_FAILURE;
}
qdf_mem_copy(cap, (((uint8_t *)param_buf->hal_reg_capabilities) +
sizeof(uint32_t)),
sizeof(struct wlan_psoc_hal_reg_capability));