From ab5cba5cbbf22d3625fdd37af025f285f747d0c5 Mon Sep 17 00:00:00 2001 From: tinlin Date: Thu, 20 Dec 2018 17:02:17 +0800 Subject: [PATCH] qcacmn: Fix NULL pointer dereference In extract_hal_reg_cap_tlv(), hal_reg_capabilities can be optionally defined. This field can be NULL resulting in a NULL pointer read. Add NULL pointer check before qdf_memory_call(). Change-Id: I142bed65e80aa9b4bb88a4e68f74235dd50e3624 CRs-Fixed: 2368284 --- wmi/src/wmi_unified_tlv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 6796e08ce641..0d97c526d415 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -8119,7 +8119,10 @@ static QDF_STATUS extract_hal_reg_cap_tlv(wmi_unified_t wmi_handle, WMI_SERVICE_READY_EVENTID_param_tlvs *param_buf; param_buf = (WMI_SERVICE_READY_EVENTID_param_tlvs *) evt_buf; - + if (!param_buf) { + WMI_LOGE("%s: Invalid arguments", __func__); + return QDF_STATUS_E_FAILURE; + } qdf_mem_copy(cap, (((uint8_t *)param_buf->hal_reg_capabilities) + sizeof(uint32_t)), sizeof(struct wlan_psoc_hal_reg_capability));