diff options
| author | Arif Hussain <arifhussain@codeaurora.org> | 2016-10-06 13:35:57 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-10-10 05:12:12 -0700 |
| commit | 4afc226c491bb4d1a04bd5cbb52ca7024ad942b5 (patch) | |
| tree | 77bfefb6352d7b2cb3d3353f181aa4322d91f3e4 | |
| parent | 61bb0bcd998a3ade96722b8b8e8a23c7fde591df (diff) | |
qcacld-3.0: Fix uninitialized variable use in cds_set_5g_channel_params
Initialize pointers bonded_chan_ptr and bonded_chan_ptr2 in function
with NULL and add check to avoid NULL/wild pointer dereference.
Change-Id: I48e4417998d75a7a42d6e55106896709016ac61c
CRs-Fixed: 1075098
| -rw-r--r-- | core/cds/src/cds_reg_service.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/core/cds/src/cds_reg_service.c b/core/cds/src/cds_reg_service.c index 32cfc719d767..302c670c0aca 100644 --- a/core/cds/src/cds_reg_service.c +++ b/core/cds/src/cds_reg_service.c @@ -449,8 +449,8 @@ static void cds_set_5g_channel_params(uint16_t oper_ch, { enum channel_state chan_state = CHANNEL_STATE_ENABLE; enum channel_state chan_state2 = CHANNEL_STATE_ENABLE; - const struct bonded_chan *bonded_chan_ptr; - const struct bonded_chan *bonded_chan_ptr2; + const struct bonded_chan *bonded_chan_ptr = NULL; + const struct bonded_chan *bonded_chan_ptr2 = NULL; if (CH_WIDTH_MAX <= ch_params->ch_width) ch_params->ch_width = CH_WIDTH_80P80MHZ; @@ -481,16 +481,19 @@ static void cds_set_5g_channel_params(uint16_t oper_ch, bonded_chan_40mhz_array, QDF_ARRAY_SIZE(bonded_chan_40mhz_array), &bonded_chan_ptr2); - if (oper_ch == bonded_chan_ptr2->start_ch) - ch_params->sec_ch_offset = + if (bonded_chan_ptr && bonded_chan_ptr2) { + if (oper_ch == + bonded_chan_ptr2->start_ch) + ch_params->sec_ch_offset = PHY_DOUBLE_CHANNEL_LOW_PRIMARY; - else - ch_params->sec_ch_offset = + else + ch_params->sec_ch_offset = PHY_DOUBLE_CHANNEL_HIGH_PRIMARY; - ch_params->center_freq_seg0 = - (bonded_chan_ptr->start_ch + - bonded_chan_ptr->end_ch)/2; + ch_params->center_freq_seg0 = + (bonded_chan_ptr->start_ch + + bonded_chan_ptr->end_ch)/2; + } } break; } @@ -501,8 +504,10 @@ static void cds_set_5g_channel_params(uint16_t oper_ch, chan_state = cds_search_5g_bonded_channel(oper_ch, CH_WIDTH_80MHZ, &bonded_chan_ptr); - ch_params->center_freq_seg0 = (bonded_chan_ptr->start_ch + - bonded_chan_ptr->end_ch)/2; + if (bonded_chan_ptr) + ch_params->center_freq_seg0 = + (bonded_chan_ptr->start_ch + + bonded_chan_ptr->end_ch)/2; } QDF_TRACE(QDF_MODULE_ID_QDF, QDF_TRACE_LEVEL_INFO, "ch %d ch_wd %d freq0 %d freq1 %d", oper_ch, |