jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

MBO: Fix possible NULL pointer dereference on candidate handling

Browse source 
If the driver provides input on MBO transition candidate handling, the
target value in get_mbo_transition_candidate() can be NULL if the driver
provided BSSID is not found in the wpa_supplicant BSS table. And later
it would be dereferenced. Fix this by adding an explicit check before
dereferencing the pointer.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Pradeep Reddy Potteti 2017-04-28 16:22:08 +05:30 committed by Jouni Malinen
parent 01dd2b1054
commit f2a04874cf
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
wpa_supplicant/wnm_sta.c
View file

@ -581,8 +581,9 @@ get_mbo_transition_candidate(struct wpa_supplicant *wpa_s,
for (i = 0; i < info->num; i++) { for (i = 0; i < info->num; i++) {
target = wpa_bss_get_bssid(wpa_s, target = wpa_bss_get_bssid(wpa_s,
info->candidates[i].bssid); info->candidates[i].bssid);
if (target->level < if (target &&
wpa_s->conf->disassoc_imminent_rssi_threshold) (target->level <
wpa_s->conf->disassoc_imminent_rssi_threshold))
continue; continue;
goto end; goto end;
} }