From patchwork Wed Jul 29 20:07:44 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 38223 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n6TK8K6a023684 for ; Wed, 29 Jul 2009 20:08:20 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755200AbZG2UIR (ORCPT ); Wed, 29 Jul 2009 16:08:17 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755184AbZG2UIR (ORCPT ); Wed, 29 Jul 2009 16:08:17 -0400 Received: from xc.sipsolutions.net ([83.246.72.84]:47341 "EHLO sipsolutions.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754510AbZG2UIR (ORCPT ); Wed, 29 Jul 2009 16:08:17 -0400 Received: by sipsolutions.net with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.69) (envelope-from ) id 1MWFRg-0006nD-Dm; Wed, 29 Jul 2009 22:08:16 +0200 Subject: [PATCH 2.6.31] cfg80211: add two missing NULL pointer checks From: Johannes Berg To: John Linville Cc: linux-wireless Date: Wed, 29 Jul 2009 22:07:44 +0200 Message-Id: <1248898064.16728.1.camel@johannes.local> Mime-Version: 1.0 X-Mailer: Evolution 2.27.4 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org These pointers can be NULL, the is_mesh() case isn't ever hit in the current kernel, but cmp_ies() can be hit under certain conditions. Signed-off-by: Johannes Berg Cc: stable@kernel.org [2.6.29, 2.6.30] --- net/wireless/scan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- wireless-testing.orig/net/wireless/scan.c 2009-07-29 21:53:49.000000000 +0200 +++ wireless-testing/net/wireless/scan.c 2009-07-29 21:57:27.000000000 +0200 @@ -141,7 +141,7 @@ static int cmp_ies(u8 num, u8 *ies1, siz if (!ie1 && !ie2) return 0; - if (!ie1) + if (!ie1 || !ie2) return -1; r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1])); @@ -194,6 +194,8 @@ static bool is_mesh(struct cfg80211_bss ie = find_ie(WLAN_EID_MESH_CONFIG, a->information_elements, a->len_information_elements); + if (!ie) + return false; if (ie[1] != IEEE80211_MESH_CONFIG_LEN) return false;