diff options
| author | gaurank kathpalia <gkathpal@codeaurora.org> | 2018-06-18 15:15:09 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-07-04 13:09:30 -0700 |
| commit | 2ae4256ed35fe8d16a9bd1037029f030d42916f4 (patch) | |
| tree | 0b81f2752108cf921ee89090f507cfac857b659b | |
| parent | 72f690b3ddb741233c70a41282b0020e9489d571 (diff) | |
qcacmn: Fix pointer dereference condition
In the API extract_roam_scan_stats_res_evt_tlv, the driver
extracts num_channels from the param_buf, which may be NULL,
and lead to pointer dereference in the same API
Fix is to have check for num_channels, and then let driver
perform tasks.
Change-Id: Iee56de8cd47cd3ea09078479e8ce34b6362b1685
CRs-Fixed: 2259297
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 11f0d412e47c..9c37be61570c 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -14702,7 +14702,7 @@ extract_roam_scan_stats_res_evt_tlv(wmi_unified_t wmi_handle, void *evt_buf, roam->trigger_value = roam_reason[i].trigger_value; } - if (chan_info) { + if (chan_info && num_channels) { for (j = 0; j < num_channels[i]; j++) roam->scan_freqs[j] = chan_info[chan_idx++]; } |