A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 06:03:36 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible NULL pointer dereference in lim_process_messages

Browse source 
In the function lim_process_messages, msg is received as the
argument. msg->bodyptr is accessed before checking if the msg is
NULL. This can cause a NULL pointer dereference if msg is NULL.

Moved the NULL check for the msg structure prior to accessing msg.

Change-Id: I61fc5fc65c9604bd5a82d7e226d9a4a9c30aebd2
CRs-Fixed:  2245791
This commit is contained in:
Pragaspathi Thilagaraj 2018-05-22 18:28:17 +05:30 • committed by nshrivas
commit b4b7aae0e1
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
core/mac/src/pe/lim/lim_process_message_queue.c
View file

@ -1486,16 +1486,18 @@ static void lim_process_messages(tpAniSirGlobal mac_ctx,
tSirTdlsInd *tdls_ind = NULL;
tpDphHashNode sta_ds = NULL;
#endif
if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
qdf_mem_free(msg->bodyptr);
msg->bodyptr = NULL;
return;
}
if (msg == NULL) {
pe_err("Message pointer is Null");
QDF_ASSERT(0);
return;
}
if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
qdf_mem_free(msg->bodyptr);
msg->bodyptr = NULL;
return;
}
#ifdef WLAN_DEBUG
mac_ctx->lim.numTot++;
#endif