Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03581806 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "wil6210: check null pointer in _wil_cfg80211_merge_extra_ies"

parents 28bc13d8 02b80626

drivers/net/wireless/ath/wil6210/cfg80211.c

+10 −2
Original line number Original line Diff line number Diff line
@@ -1852,6 +1852,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, 
	u8 *buf, *dpos;

	u8 *buf, *dpos;

	const u8 *spos;

	const u8 *spos;





	if (!ies1)

		ies1_len = 0;



	if (!ies2)

		ies2_len = 0;



	if (ies1_len == 0 && ies2_len == 0) {

	if (ies1_len == 0 && ies2_len == 0) {

		*merged_ies = NULL;

		*merged_ies = NULL;

		*merged_len = 0;

		*merged_len = 0;
@@ -1861,6 +1867,7 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, 
	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);

	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);

	if (!buf)

	if (!buf)

		return -ENOMEM;

		return -ENOMEM;

	if (ies1)

		memcpy(buf, ies1, ies1_len);

		memcpy(buf, ies1, ies1_len);

	dpos = buf + ies1_len;

	dpos = buf + ies1_len;

	spos = ies2;

	spos = ies2;
@@ -1871,7 +1878,8 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, 
		if (spos + ielen > ies2 + ies2_len)

		if (spos + ielen > ies2 + ies2_len)

			break;

			break;

		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&

		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&

		    !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {

		    (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,

						     spos, ielen))) {

			memcpy(dpos, spos, ielen);

			memcpy(dpos, spos, ielen);

			dpos += ielen;

			dpos += ielen;

		}

		}