qcacmn: Fix NULL pointer dereference of roam stats event param buf
In extract_roam_scan_ap_stats_tlv, if param buf is null, null pointer dereference can happen while trying to access num_roam_ap_info in the error message print. Return failure if param_buf is NULL Change-Id: I9f5cbb5534d1ef58bb9406ba8dc0aa68a9f8c194 CRs-Fixed: 2669350
这个提交包含在:
@@ -13056,9 +13056,14 @@ extract_roam_scan_ap_stats_tlv(wmi_unified_t wmi_handle, void *evt_buf,
|
||||
uint8_t i;
|
||||
|
||||
param_buf = (WMI_ROAM_STATS_EVENTID_param_tlvs *)evt_buf;
|
||||
if (!param_buf || ap_idx >= param_buf->num_roam_ap_info) {
|
||||
WMI_LOGE("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
|
||||
ap_idx, param_buf->num_roam_ap_info);
|
||||
if (!param_buf) {
|
||||
wmi_err("Param buf is NULL");
|
||||
return QDF_STATUS_E_FAILURE;
|
||||
}
|
||||
|
||||
if (ap_idx >= param_buf->num_roam_ap_info) {
|
||||
wmi_err("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
|
||||
ap_idx, param_buf->num_roam_ap_info);
|
||||
return QDF_STATUS_E_FAILURE;
|
||||
}
|
||||
|
||||
|
在新工单中引用
屏蔽一个用户