Browse Source

qcacld-3.0: Fix NULL pointer dereference in __lim_process_sme_join_req

In function __lim_process_sme_join_req, access session id and transaction
id from msg_buff instead of sme_join_req which could be null at the point
of access.

Change-Id: I299b87f6144d0b6452d49ebc9d8ed28ff417723c
CRs-Fixed: 1034255
Naveen Rawat 8 years ago
parent
commit
9ea7470dde
1 changed files with 2 additions and 2 deletions
  1. 2 2
      core/mac/src/pe/lim/lim_process_sme_req_messages.c

+ 2 - 2
core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -2066,8 +2066,8 @@ __lim_process_sme_join_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf)
 	}
 
 end:
-	sme_session_id = sme_join_req->sessionId;
-	sme_transaction_id = sme_join_req->transactionId;
+	sme_session_id = ((tpSirSmeJoinReq)msg_buf)->sessionId;
+	sme_transaction_id = ((tpSirSmeJoinReq)msg_buf)->transactionId;
 
 	if (sme_join_req) {
 		qdf_mem_free(sme_join_req);