Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a56ba8d authored by William Escande's avatar William Escande
Browse files

PAN: prevent NPE 

in some circumstances p_buf can be free which render the p_buf->len
invalid.
Caching the len prevent it

Bug: 328841515
Fix: 328841515
Test: None
Flag: Exempt, null pointer prevention
Change-Id: I2ca2478f6baf7d0a2a96f62121ec4686ecf2b2ee
parent dd523030

system/stack/pan/pan_api.cc

+2 −1
Original line number Original line Diff line number Diff line
@@ -522,6 +522,7 @@ tPAN_RESULT PAN_WriteBuf(uint16_t handle, const RawAddress& dst, const RawAddres 
      return PAN_FAILURE;

      return PAN_FAILURE;

    }

    }





    uint16_t len = p_buf->len;

    result = BNEP_WriteBuf(pan_cb.pcb[i].handle, dst, p_buf, protocol, src, ext);

    result = BNEP_WriteBuf(pan_cb.pcb[i].handle, dst, p_buf, protocol, src, ext);

    if (result == BNEP_IGNORE_CMD) {

    if (result == BNEP_IGNORE_CMD) {

      log::verbose("PAN ignored data write for PANU connection");

      log::verbose("PAN ignored data write for PANU connection");
@@ -531,7 +532,7 @@ tPAN_RESULT PAN_WriteBuf(uint16_t handle, const RawAddress& dst, const RawAddres 
      return (tPAN_RESULT)result;

      return (tPAN_RESULT)result;

    }

    }





    pan_cb.pcb[i].write.octets += p_buf->len;

    pan_cb.pcb[i].write.octets += len;

    pan_cb.pcb[i].write.packets++;

    pan_cb.pcb[i].write.packets++;





    log::verbose("PAN successfully wrote data for the PANU connection");

    log::verbose("PAN successfully wrote data for the PANU connection");