From b4b7aae0e18084f05982f29cbe33d1574cd771b3 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Tue, 22 May 2018 18:28:17 +0530 Subject: [PATCH] qcacld-3.0: Fix possible NULL pointer dereference in lim_process_messages In the function lim_process_messages, msg is received as the argument. msg->bodyptr is accessed before checking if the msg is NULL. This can cause a NULL pointer dereference if msg is NULL. Moved the NULL check for the msg structure prior to accessing msg. Change-Id: I61fc5fc65c9604bd5a82d7e226d9a4a9c30aebd2 CRs-Fixed: 2245791 --- core/mac/src/pe/lim/lim_process_message_queue.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c index 283ba2d8023c..8f3d26eef82f 100644 --- a/core/mac/src/pe/lim/lim_process_message_queue.c +++ b/core/mac/src/pe/lim/lim_process_message_queue.c @@ -1486,16 +1486,18 @@ static void lim_process_messages(tpAniSirGlobal mac_ctx, tSirTdlsInd *tdls_ind = NULL; tpDphHashNode sta_ds = NULL; #endif - if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) { - qdf_mem_free(msg->bodyptr); - msg->bodyptr = NULL; - return; - } if (msg == NULL) { pe_err("Message pointer is Null"); QDF_ASSERT(0); return; } + + if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) { + qdf_mem_free(msg->bodyptr); + msg->bodyptr = NULL; + return; + } + #ifdef WLAN_DEBUG mac_ctx->lim.numTot++; #endif