فهرست منبع

qcacld-3.0: Fix possible NULL pointer dereference in lim_send_mlm_assoc_ind

In SAP mode, when a STA is associated, the assoc request is
stored in session_entry->parsedAssocReq. The function
lim_send_mlm_assoc_ind is called to indicate the association to
SME. In lim_send_mlm_assoc_ind, parsedAssocReq is copied to
assoc_req which fills the assoc_ind to be sent to sme,
and session_entry->parsedAssocReq is dereferenced before
validating it against NULL. This could result in NULL pointer
dereference.

Add NULL pointer check before dereferencing parsedAssocReq.
Return if it fails.

Change-Id: Ied2b5f64c0351a648c1d398f616450aa406fc82e
CRs-Fixed: 2348565
Pragaspathi Thilagaraj 6 سال پیش
والد
کامیت
aba1b5d830
1فایلهای تغییر یافته به همراه10 افزوده شده و 0 حذف شده
  1. 10 0
      core/mac/src/pe/lim/lim_process_assoc_req_frame.c

+ 10 - 0
core/mac/src/pe/lim/lim_process_assoc_req_frame.c

@@ -2310,10 +2310,20 @@ void lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
 	uint8_t maxidx, i;
 	bool wme_enable;
 
+	if (!session_entry->parsedAssocReq) {
+		pe_err(" Parsed Assoc req is NULL");
+		return;
+	}
+
 	/* Get a copy of the already parsed Assoc Request */
 	assoc_req =
 		(tpSirAssocReq) session_entry->parsedAssocReq[sta_ds->assocId];
 
+	if (!assoc_req) {
+		pe_err("assoc req for assoc_id:%d is NULL", sta_ds->assocId);
+		return;
+	}
+
 	/* Get the phy_mode */
 	lim_get_phy_mode(mac_ctx, &phy_mode, session_entry);