commit ad2c9d8e33a05d2e3a55a088f63186639b2ef80c
author guo-jie.wang <guo-jie.wang@mediatek.com> Fri Dec 01 19:49:54 2017 +0800
committer Guo-Jie Wang <guo-jie.wang@mediatek.com> Tue Dec 05 13:08:32 2017 +0800
tree acd60e13ab4ba73f1d13fba9efb75fd7e0ea99bd
parent 9fe32f5f463e16d6edc3593c9b99fedb096c2697

[WCNCR00166525] misc: fix coverity issues

[Description]
Fix CID
2496642 Dereference null return value
4065171 Calling risky function
4077560 Array compared against 0

Change-Id: I9eb3036e682aa66ab8eb2ee30184f5eae323419d
CR-Id: WCNCR00166525
Feature: misc
Signed-off-by: guo-jie.wang <guo-jie.wang@mediatek.com>
Reviewed-on: http://gerrit.mediatek.inc:8080/1228393
CheckPatch: Check Patch <srv_checkpatch@mediatek.com>
Reviewed-by: Sarick Jiang <sarick.jiang@mediatek.com>
Reviewed-by: George Kuo <george.kuo@mediatek.com>
Build: srv_neptune_adm <srv_neptune_adm@mediatek.com>

mgmt/p2p_role_state.c

diff --git a/mgmt/p2p_role_state.c b/mgmt/p2p_role_state.c
index 7525eaa..185baa9 100644
--- a/mgmt/p2p_role_state.c
+++ b/mgmt/p2p_role_state.c
@@ -85,8 +85,7 @@
 			prP2pDevFsmInfo = prAdapter->rWifiVar.prP2pDevFsmInfo;
 			if (prP2pDevFsmInfo) {
 				prDevScanReqInfo = &(prP2pDevFsmInfo->rScanReqInfo);
-				if ((prDevScanReqInfo->u4BufLength != 0) &&
-					(prDevScanReqInfo->aucIEBuf)) {
+				if (prDevScanReqInfo->u4BufLength != 0) {
 					/* IE Buffer */
 					kalMemCopy(prScanReqInfo->aucIEBuf, prDevScanReqInfo->aucIEBuf,
 							prDevScanReqInfo->u4BufLength);

mgmt/rsn.c

diff --git a/mgmt/rsn.c b/mgmt/rsn.c
index 3e8d554..cc0bc86 100644
--- a/mgmt/rsn.c
+++ b/mgmt/rsn.c
@@ -2833,6 +2833,11 @@
 	prRxFrame = (P_ACTION_SA_QUERY_FRAME) prSwRfb->pvHeader;
 	prStaRec = cnmGetStaRecByIndex(prAdapter, prSwRfb->ucStaRecIdx);
 
+	if (!prStaRec) {
+		DBGLOG(RSN, WARN, "NULL prStaRec!\n");
+		return;
+	}
+
 	DBGLOG(RSN, TRACE, "AP PMF SAQ action enter from " MACSTR "\n", MAC2STR(prStaRec->aucMacAddr));
 	if (prSwRfb->u2PacketLen < ACTION_SA_QUERY_TR_ID_LEN) {
 		DBGLOG(RSN, INFO, "IEEE 802.11: Too short SA Query Action frame (len=%lu)\n",

os/linux/gl_wext_priv.c

diff --git a/os/linux/gl_wext_priv.c b/os/linux/gl_wext_priv.c
index 7071cf7..241f047 100644
--- a/os/linux/gl_wext_priv.c
+++ b/os/linux/gl_wext_priv.c
@@ -9094,13 +9094,17 @@
 		for (cIdx2 = 0; cIdx2 < ucChannelNum; cIdx2++) {
 			if (prChnLoadInfo->rChnRankList[cIdx].ucChannel ==
 				prChannelList[cIdx2].ucChannelNum) {
-				u4Offset = kalSprintf(pcCommand + i4BytesWritten,
+				u4Offset = kalSnprintf(pcCommand + i4BytesWritten,
+							i4TotalLen - i4BytesWritten,
 							"\nch %03u -> dirtiness %lu",
 							prChnLoadInfo->rChnRankList[cIdx].ucChannel,
 							prChnLoadInfo->rChnRankList[cIdx].u4Dirtiness);
 				i4BytesWritten += u4Offset;
 				break;
 			}
+
+			if (i4BytesWritten >= i4TotalLen)
+				return i4BytesWritten;
 		}
 	}