diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2016-06-15 11:07:24 -0700 |
|---|---|---|
| committer | Nandini Suresh <snandini@codeaurora.org> | 2016-07-14 18:50:50 -0700 |
| commit | a395d25d534f5cd6818cfbc8faf6ea465aa899f2 (patch) | |
| tree | d41aeb022d80764c101527d71b1995e270047555 | |
| parent | fbf5068ddd8397d817f98e527f2505d0510096a2 (diff) | |
qcacld-3.0: Fix NULL pointer dereference in csr_roam_join_next_bss
Add NULL pointer check for "result" after call to csr_roam_select_bss.
This function can return a NULL value for variable "result", which is
later dereference in the function csr_roam_join_handle_profile.
Change-Id: I5e1f017de49301a14b899692b888f7694e979bf1
CRs-Fixed: 1027725
| -rw-r--r-- | core/sme/src/csr/csr_api_roam.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index ae83a030c6b0..dadf022d33f8 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -5266,8 +5266,15 @@ static eCsrJoinState csr_roam_join_next_bss(tpAniSirGlobal mac_ctx, if (!roam_info_ptr) roam_info_ptr = &roam_info; roam_info_ptr->u.pConnectedProfile = &session->connectedProfile; - csr_roam_join_handle_profile(mac_ctx, session_id, cmd, roam_info_ptr, - &roam_state, result, scan_result); + + /* + * result will be null if passed pRoamBssEntry is NULL, which + * indicates we are done with all BSSs in list. + */ + if (result != NULL) + csr_roam_join_handle_profile(mac_ctx, session_id, cmd, + roam_info_ptr, &roam_state, + result, scan_result); end: if ((eCsrStopRoaming == roam_state) && CSR_IS_INFRASTRUCTURE(profile) && (session->bRefAssocStartCnt > 0)) { |