diff options
| author | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | 2018-11-28 15:33:21 +0530 |
|---|---|---|
| committer | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | 2018-12-10 13:04:09 +0530 |
| commit | 6ef2dfa1d6584c4a9394e25c85c57839ed56bb13 (patch) | |
| tree | 153f773d3cd6c8caaa41a31bbd572717940c10d8 /lib/flex_array.c | |
| parent | 403164d912ecf69de5afa70d8acbf276facba8c8 (diff) | |
qcacmn: Fix null pointer dereference in extract_sar_limit_event_tlv
When WMI_SAR_GET_LIMITS_EVENTID is received from firmware, the
function extract_sar_limit_event_tlv is called to update the SAR
limits for all the chains of each band. There is a for loop
defined to loop over each item in param_buf->sar_get_limits.
Since the param_buf->sar_get_limits could be either optionally
defined or not a part of the message at all there is a potential
NULL pointer dereference if sar_get_limits is not sent as part
of the WMI_SAR_GET_LIMITS_EVENTID event.
param_buf->sar_get_limits needs to be checked for NULL prior to
derefencing it.
Change-Id: I93c07fa8048df97c6f6960b0db6df3bbc30e23b4
CRs-Fixed: 2336928
Diffstat (limited to 'lib/flex_array.c')
0 files changed, 0 insertions, 0 deletions
