Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 554b4644 authored by Hardik Arya's avatar Hardik Arya Committed by Gerrit - the friendly Code Review server
Browse files

diag: Add NULL pointer checks for upd buffer 



Currently there is a possibility of NULL pointer
dereference issue due to NULL pointers checks are
missing for upd buffer. The patch fixes the issue by
adding NULL pointer checks.

CRs-Fixed: 2146788
Change-Id: I3da40d9abd77e1825903c530f2311f9c2376fd5f
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent 26e00d5b

drivers/char/diag/diagfwd_peripheral.c

+6 −2
Original line number Diff line number Diff line
@@ -476,7 +476,8 @@ static void diagfwd_data_read_untag_done(struct diagfwd_info *fwd_info, 
			flag_buf_1 = 1;

			temp_fwdinfo_cpd = fwd_info->buf_1;

			if (fwd_info->type == TYPE_DATA) {

				for (i = 0; i <= (fwd_info->num_pd - 2); i++)

				for (i = 0; (i <= (fwd_info->num_pd - 2)) &&

					fwd_info->buf_upd[i][0]; i++)

					temp_buf_upd[i] =

					fwd_info->buf_upd[i][0]->data_raw;

			}
@@ -485,7 +486,8 @@ static void diagfwd_data_read_untag_done(struct diagfwd_info *fwd_info, 
			flag_buf_2 = 1;

			temp_fwdinfo_cpd = fwd_info->buf_2;

			if (fwd_info->type == TYPE_DATA) {

				for (i = 0; i <= (fwd_info->num_pd - 2); i++)

				for (i = 0; (i <= (fwd_info->num_pd - 2)) &&

					fwd_info->buf_upd[i][1]; i++)

					temp_buf_upd[i] =

					fwd_info->buf_upd[i][1]->data_raw;

			}
@@ -555,6 +557,8 @@ static void diagfwd_data_read_untag_done(struct diagfwd_info *fwd_info, 
				else

					temp_fwdinfo_upd =

						fwd_info->buf_upd[i][1];

				if (!temp_fwdinfo_upd)

					break;

				temp_fwdinfo_upd->ctxt &= 0x00FFFFFF;

				temp_fwdinfo_upd->ctxt |=

					(SET_PD_CTXT(ctxt_upd[i]));