Browse Source

qcacmn: Fix NULL pointer dereference

In extract_hal_reg_cap_tlv(), hal_reg_capabilities
can be optionally defined. This field can be NULL
resulting in a NULL pointer read. Add NULL pointer
check before qdf_memory_call().

Change-Id: I142bed65e80aa9b4bb88a4e68f74235dd50e3624
CRs-Fixed: 2368284
tinlin 6 years ago
parent
commit
ab5cba5cbb
1 changed files with 4 additions and 1 deletions
  1. 4 1
      wmi/src/wmi_unified_tlv.c

+ 4 - 1
wmi/src/wmi_unified_tlv.c

@@ -8119,7 +8119,10 @@ static QDF_STATUS extract_hal_reg_cap_tlv(wmi_unified_t wmi_handle,
 	WMI_SERVICE_READY_EVENTID_param_tlvs *param_buf;
 
 	param_buf = (WMI_SERVICE_READY_EVENTID_param_tlvs *) evt_buf;
-
+	if (!param_buf) {
+		WMI_LOGE("%s: Invalid arguments", __func__);
+		return QDF_STATUS_E_FAILURE;
+	}
 	qdf_mem_copy(cap, (((uint8_t *)param_buf->hal_reg_capabilities) +
 		sizeof(uint32_t)),
 		sizeof(struct wlan_psoc_hal_reg_capability));