Explorar o código

qcacld-3.0: check return value to avoild NULL pointer

Pointer 'ie_struct' returned from call to function
wlan_get_parsed_bss_description_ies, it may be NULL,
if not checking the function return status, this pointer
may be dereferenced. Check the return status to avoid it.
Free the allocated memory for error exit case.

Change-Id: I4d813838f25b5e2ad3069ad9547bb95f8f6a0e5b
CRs-Fixed: 3016814
Zhaoyang Liu %!s(int64=3) %!d(string=hai) anos
pai
achega
f98319b751
Modificáronse 1 ficheiros con 10 adicións e 2 borrados
  1. 10 2
      core/mac/src/pe/lim/lim_process_sme_req_messages.c

+ 10 - 2
core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -4491,7 +4491,13 @@ lim_fill_preauth_req_dot11_mode(struct mac_context *mac_ctx,
 	enum mlme_dot11_mode intersected_mode;
 	struct bss_description *bss_desc = req->pbssDescription;
 
-	wlan_get_parsed_bss_description_ies(mac_ctx, bss_desc, &ie_struct);
+	status = wlan_get_parsed_bss_description_ies(mac_ctx, bss_desc,
+						     &ie_struct);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		mlme_err("IE parsing failed");
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	self_dot11_mode = lim_get_self_dot11_mode(mac_ctx, QDF_STA_MODE);
 	bss_dot11_mode = lim_get_bss_dot11_mode(bss_desc, ie_struct);
 
@@ -4499,8 +4505,10 @@ lim_fill_preauth_req_dot11_mode(struct mac_context *mac_ctx,
 						       bss_dot11_mode,
 						       &intersected_mode,
 						       ie_struct, bss_desc);
-	if (QDF_IS_STATUS_ERROR(status))
+	if (QDF_IS_STATUS_ERROR(status)) {
+		qdf_mem_free(ie_struct);
 		return status;
+	}
 
 	req->dot11mode = intersected_mode;
 	pe_debug("self dot11mode %d bss_dot11 mode %d intersected_mode %d",