diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2017-03-12 08:14:40 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-03-12 08:14:40 +0000 |
| commit | 5d8fa8946fbf2d49970defe3295cf44b94f8bc72 (patch) | |
| tree | 0481d1d04427aefe600074d90e2c8592462d6a8d | |
| parent | 6d2b913f5f4aac15a813e6fd4ac17309fdcfd17f (diff) | |
| parent | 272d60bfce0e8222d2b1fe479a98fdf3bf7e05d0 (diff) | |
staging: rtl: fix possible NULL pointer dereference
am: 272d60bfce
Change-Id: I49cd1afa12c293484de6c18eb31e67d2baa0a4d4
| -rw-r--r-- | drivers/staging/rtl8188eu/core/rtw_recv.c | 3 | ||||
| -rw-r--r-- | drivers/staging/rtl8712/rtl871x_recv.c | 7 |
2 files changed, 9 insertions, 1 deletions
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c index 110b8c0b6cd7..0f2fe34e14c2 100644 --- a/drivers/staging/rtl8188eu/core/rtw_recv.c +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c @@ -1405,6 +1405,9 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); } + if (!ptr) + return _FAIL; + memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c index 4ff530155187..04ac23cc47a8 100644 --- a/drivers/staging/rtl8712/rtl871x_recv.c +++ b/drivers/staging/rtl8712/rtl871x_recv.c @@ -641,11 +641,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) /* append rx status for mp test packets */ ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24); + if (!ptr) + return _FAIL; memcpy(ptr, get_rxmem(precvframe), 24); ptr += 24; - } else + } else { ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); + if (!ptr) + return _FAIL; + } memcpy(ptr, pattrib->dst, ETH_ALEN); memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); |