1
0

qcacld-3.0: Fix possible NULL pointer dereference in lim_process_messages

In the function lim_process_messages, msg is received as the
argument. msg->bodyptr is accessed before checking if the msg is
NULL. This can cause a NULL pointer dereference if msg is NULL.

Moved the NULL check for the msg structure prior to accessing msg.

Change-Id: I61fc5fc65c9604bd5a82d7e226d9a4a9c30aebd2
CRs-Fixed:  2245791
Este cometimento está contido em:
Pragaspathi Thilagaraj
2018-05-22 18:28:17 +05:30
cometido por nshrivas
ascendente 2de7d6ef8e
cometimento b4b7aae0e1

Ver ficheiro

@@ -1486,16 +1486,18 @@ static void lim_process_messages(tpAniSirGlobal mac_ctx,
tSirTdlsInd *tdls_ind = NULL;
tpDphHashNode sta_ds = NULL;
#endif
if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
qdf_mem_free(msg->bodyptr);
msg->bodyptr = NULL;
return;
}
if (msg == NULL) {
pe_err("Message pointer is Null");
QDF_ASSERT(0);
return;
}
if (ANI_DRIVER_TYPE(mac_ctx) == QDF_DRIVER_TYPE_MFG) {
qdf_mem_free(msg->bodyptr);
msg->bodyptr = NULL;
return;
}
#ifdef WLAN_DEBUG
mac_ctx->lim.numTot++;
#endif