From dbae6c684b510275fe9727ef31a84ce5bd152e37 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Fri, 17 Feb 2017 14:41:19 -0800 Subject: qcacld-3.0: Fix possible NULL pointer dereference In function sme_get_beacon_frm, csr_get_fst_bssdescr_ptr can return a NULL pointer. Check it against NULL before usage. Change-Id: I76112adf9a0a618bf7e956911d68e7ee2edac61e CRs-Fixed: 2008664 --- core/sme/src/common/sme_api.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index 7c476cfe12db..b70d41c28678 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -17381,6 +17381,11 @@ QDF_STATUS sme_get_beacon_frm(tHalHandle hal, tCsrRoamProfile *profile, bss_list = (tScanResultList *)result_handle; bss_descp = csr_get_fst_bssdescr_ptr(bss_list); + if (!bss_descp) { + sms_log(mac_ctx, LOGE, FL("unable to fetch bss descriptor")); + status = QDF_STATUS_E_FAULT; + goto free_scan_flter; + } /* * bss_descp->length = sizeof(tSirBssDescription) - sizeof(length_field) @@ -17411,6 +17416,6 @@ free_scan_flter: if (result_handle) csr_scan_result_purge(mac_ctx, result_handle); - return QDF_STATUS_SUCCESS; + return status; } -- cgit v1.2.3