samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Garpu 0
Kode Masalah Tarik Permintaan Actions Packages Projects Rilis Wiki Kegiatan

qcacld-3.0: Fix null pointer dereference in sending probe req

Telusuri Sumber 
Add null check when accessing additional_ielen in function
lim_send_probe_req_mgmt_frame function to avoid null pointer
dereference.

Change-Id: Ida382b274d211431ba808817cb0d5e9c3f783c0c
CRs-Fixed: 2229848
This commit is contained in:
Arif Hussain
2018-04-23 18:55:26 -07:00
committed by nshrivas
orang tua 23183d6c73
melakukan 4c26513ac4
1 mengubah file dengan 6 tambahan dan 2 penghapusan
Download Patch File Download Diff File Expand all files Collapse all files

8
core/mac/src/pe/lim/lim_send_management_frames.c
Melihat File

@@ -217,12 +217,15 @@ lim_send_probe_req_mgmt_frame(tpAniSirGlobal mac_ctx,
uint8_t sme_sessionid = 0;
bool is_vht_enabled = false;
uint8_t txPower;
uint16_t addn_ielen = *additional_ielen;
uint16_t addn_ielen = 0;
bool extracted_ext_cap_flag = false;
tDot11fIEExtCap extracted_ext_cap;
tSirRetStatus sir_status;
const uint8_t *qcn_ie = NULL;
if (additional_ielen)
addn_ielen = *additional_ielen;
/* The probe req should not send 11ac capabilieties if band is 2.4GHz,
* unless enableVhtFor24GHz is enabled in INI. So if enableVhtFor24GHz
* is false and dot11mode is 11ac set it to 11n.
@@ -364,7 +367,8 @@ lim_send_probe_req_mgmt_frame(tpAniSirGlobal mac_ctx,
(&extracted_ext_cap);
extracted_ext_cap_flag =
(extracted_ext_cap.num_bytes > 0);
*additional_ielen = addn_ielen;
if (additional_ielen)
*additional_ielen = addn_ielen;
}
qcn_ie = wlan_get_vendor_ie_ptr_from_oui(SIR_MAC_QCN_OUI_TYPE,
SIR_MAC_QCN_OUI_TYPE_SIZE,