Commit cd3468ba authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville

cfg80211: add two missing NULL pointer checks

These pointers can be NULL, the is_mesh() case isn't
ever hit in the current kernel, but cmp_ies() can be
hit under certain conditions.
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.29, 2.6.30]
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent eb4ad826
...@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2) ...@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
if (!ie1 && !ie2) if (!ie1 && !ie2)
return 0; return 0;
if (!ie1) if (!ie1 || !ie2)
return -1; return -1;
r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1])); r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
...@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a, ...@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
ie = find_ie(WLAN_EID_MESH_CONFIG, ie = find_ie(WLAN_EID_MESH_CONFIG,
a->information_elements, a->information_elements,
a->len_information_elements); a->len_information_elements);
if (!ie)
return false;
if (ie[1] != IEEE80211_MESH_CONFIG_LEN) if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
return false; return false;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment