Browse Source

qcacmn: Fix NULL pointer dereference of roam stats event param buf

In extract_roam_scan_ap_stats_tlv, if param buf is null, null
pointer dereference can happen while trying to access
num_roam_ap_info in the error message print.

Return failure if param_buf is NULL

Change-Id: I9f5cbb5534d1ef58bb9406ba8dc0aa68a9f8c194
CRs-Fixed: 2669350
Pragaspathi Thilagaraj 5 years ago
parent
commit
2b12f986bb
1 changed files with 8 additions and 3 deletions
  1. 8 3
      wmi/src/wmi_unified_tlv.c

+ 8 - 3
wmi/src/wmi_unified_tlv.c

@@ -13056,9 +13056,14 @@ extract_roam_scan_ap_stats_tlv(wmi_unified_t wmi_handle, void *evt_buf,
 	uint8_t i;
 	uint8_t i;
 
 
 	param_buf = (WMI_ROAM_STATS_EVENTID_param_tlvs *)evt_buf;
 	param_buf = (WMI_ROAM_STATS_EVENTID_param_tlvs *)evt_buf;
-	if (!param_buf || ap_idx >= param_buf->num_roam_ap_info) {
-		WMI_LOGE("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
-			 ap_idx, param_buf->num_roam_ap_info);
+	if (!param_buf) {
+		wmi_err("Param buf is NULL");
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	if (ap_idx >= param_buf->num_roam_ap_info) {
+		wmi_err("Invalid roam scan AP tlv ap_idx:%d total_ap:%d",
+			ap_idx, param_buf->num_roam_ap_info);
 		return QDF_STATUS_E_FAILURE;
 		return QDF_STATUS_E_FAILURE;
 	}
 	}