Browse Source

qcacld-3.0: Fix possible NULL pointer dereference in lim_process_messages

In the function lim_process_messages, msg is received as the
argument. msg->bodyptr is accessed before checking if the msg is
NULL. This can cause a NULL pointer dereference if msg is NULL.

Moved the NULL check for the msg structure prior to accessing msg.

Change-Id: I61fc5fc65c9604bd5a82d7e226d9a4a9c30aebd2
CRs-Fixed:  2245791
Pragaspathi Thilagaraj 6 years ago
parent
commit
b4b7aae0e1
1 changed files with 7 additions and 5 deletions
  1. 7 5
      core/mac/src/pe/lim/lim_process_message_queue.c

+ 7 - 5
core/mac/src/pe/lim/lim_process_message_queue.c

@@ -1486,16 +1486,18 @@ static void lim_process_messages(tpAniSirGlobal mac_ctx,
 	tSirTdlsInd *tdls_ind = NULL;
 	tpDphHashNode sta_ds = NULL;
 #endif
-	if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
-		qdf_mem_free(msg->bodyptr);
-		msg->bodyptr = NULL;
-		return;
-	}
 	if (msg == NULL) {
 		pe_err("Message pointer is Null");
 		QDF_ASSERT(0);
 		return;
 	}
+
+	if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
+		qdf_mem_free(msg->bodyptr);
+		msg->bodyptr = NULL;
+		return;
+	}
+
 #ifdef WLAN_DEBUG
 	mac_ctx->lim.numTot++;
 #endif