From a395d25d534f5cd6818cfbc8faf6ea465aa899f2 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Wed, 15 Jun 2016 11:07:24 -0700 Subject: qcacld-3.0: Fix NULL pointer dereference in csr_roam_join_next_bss Add NULL pointer check for "result" after call to csr_roam_select_bss. This function can return a NULL value for variable "result", which is later dereference in the function csr_roam_join_handle_profile. Change-Id: I5e1f017de49301a14b899692b888f7694e979bf1 CRs-Fixed: 1027725 --- core/sme/src/csr/csr_api_roam.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index ae83a030c6b0..dadf022d33f8 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -5266,8 +5266,15 @@ static eCsrJoinState csr_roam_join_next_bss(tpAniSirGlobal mac_ctx, if (!roam_info_ptr) roam_info_ptr = &roam_info; roam_info_ptr->u.pConnectedProfile = &session->connectedProfile; - csr_roam_join_handle_profile(mac_ctx, session_id, cmd, roam_info_ptr, - &roam_state, result, scan_result); + + /* + * result will be null if passed pRoamBssEntry is NULL, which + * indicates we are done with all BSSs in list. + */ + if (result != NULL) + csr_roam_join_handle_profile(mac_ctx, session_id, cmd, + roam_info_ptr, &roam_state, + result, scan_result); end: if ((eCsrStopRoaming == roam_state) && CSR_IS_INFRASTRUCTURE(profile) && (session->bRefAssocStartCnt > 0)) { -- cgit v1.2.3