1
0

qcacmn: Fix NULL pointer dereference of roam stats event param buf

In extract_roam_scan_ap_stats_tlv, if param buf is null, null
pointer dereference can happen while trying to access
num_roam_ap_info in the error message print.

Return failure if param_buf is NULL

Change-Id: I9f5cbb5534d1ef58bb9406ba8dc0aa68a9f8c194
CRs-Fixed: 2669350
Este cometimento está contido em:
Pragaspathi Thilagaraj
2020-04-23 11:15:50 +05:30
cometido por nshrivas
ascendente d34f264b07
cometimento 2b12f986bb

Ver ficheiro

@@ -13056,9 +13056,14 @@ extract_roam_scan_ap_stats_tlv(wmi_unified_t wmi_handle, void *evt_buf,
uint8_t i;
param_buf = (WMI_ROAM_STATS_EVENTID_param_tlvs *)evt_buf;
if (!param_buf || ap_idx >= param_buf->num_roam_ap_info) {
WMI_LOGE("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
ap_idx, param_buf->num_roam_ap_info);
if (!param_buf) {
wmi_err("Param buf is NULL");
return QDF_STATUS_E_FAILURE;
}
if (ap_idx >= param_buf->num_roam_ap_info) {
wmi_err("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
ap_idx, param_buf->num_roam_ap_info);
return QDF_STATUS_E_FAILURE;
}