samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix null pointer dereference in sending probe req

Browse Source 
Add null check when accessing additional_ielen in function
lim_send_probe_req_mgmt_frame function to avoid null pointer
dereference.

Change-Id: Ida382b274d211431ba808817cb0d5e9c3f783c0c
CRs-Fixed: 2229848
This commit is contained in:
Arif Hussain
2018-04-23 18:55:26 -07:00
committed by nshrivas
parent 23183d6c73
commit 4c26513ac4
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/mac/src/pe/lim/lim_send_management_frames.c
View File

@@ -217,12 +217,15 @@ lim_send_probe_req_mgmt_frame(tpAniSirGlobal mac_ctx,
uint8_t sme_sessionid = 0; uint8_t sme_sessionid = 0;
bool is_vht_enabled = false; bool is_vht_enabled = false;
uint8_t txPower; uint8_t txPower;
uint16_t addn_ielen = *additional_ielen; uint16_t addn_ielen = 0;
bool extracted_ext_cap_flag = false; bool extracted_ext_cap_flag = false;
tDot11fIEExtCap extracted_ext_cap; tDot11fIEExtCap extracted_ext_cap;
tSirRetStatus sir_status; tSirRetStatus sir_status;
const uint8_t *qcn_ie = NULL; const uint8_t *qcn_ie = NULL;
if (additional_ielen)
addn_ielen = *additional_ielen;
/* The probe req should not send 11ac capabilieties if band is 2.4GHz, /* The probe req should not send 11ac capabilieties if band is 2.4GHz,
* unless enableVhtFor24GHz is enabled in INI. So if enableVhtFor24GHz * unless enableVhtFor24GHz is enabled in INI. So if enableVhtFor24GHz
* is false and dot11mode is 11ac set it to 11n. * is false and dot11mode is 11ac set it to 11n.
@@ -364,7 +367,8 @@ lim_send_probe_req_mgmt_frame(tpAniSirGlobal mac_ctx,
(&extracted_ext_cap); (&extracted_ext_cap);
extracted_ext_cap_flag = extracted_ext_cap_flag =
(extracted_ext_cap.num_bytes > 0); (extracted_ext_cap.num_bytes > 0);
*additional_ielen = addn_ielen; if (additional_ielen)
*additional_ielen = addn_ielen;
} }
qcn_ie = wlan_get_vendor_ie_ptr_from_oui(SIR_MAC_QCN_OUI_TYPE, qcn_ie = wlan_get_vendor_ie_ptr_from_oui(SIR_MAC_QCN_OUI_TYPE,
SIR_MAC_QCN_OUI_TYPE_SIZE, SIR_MAC_QCN_OUI_TYPE_SIZE,