[DTV00857290][DTV][Coverity Scanned Code Defect]
[Description]
Fix coverity defects under nic/que_mgt.c.
Fix Dereference after null check.
- Cid#361481 in line 4635.
Fix Dereference null return value.
- Cid#361508 in line 815.
Fix Illegal address computation.
- Cid#361516 in line 861.
Checkout value of 'ucQueIdx' in line 858.
Fix Out-of-bounds read
- Cid#361515 in line 856.
Checkout value of 'ucQueIdx' in line 858.
Change-Id: I47011edf7c025e07c9326c1fe937f67d9a199874
Signed-off-by: Alice Ou <alice.ou@mediatek.com>
(cherry picked from commit 059630664d32d49d403b60fb6a73f1523bd28b1f)
CR-Id: DTV00857290
(cherry picked from commit 54397037c56ed899a3d4cd1b053a34aebf5e75e8)
(cherry picked from commit 741fb6ee629c53f72f855272f13fa2028e66e963)
diff --git a/nic/que_mgt.c b/nic/que_mgt.c
index 02ec80e..e27e6a3 100644
--- a/nic/que_mgt.c
+++ b/nic/que_mgt.c
@@ -820,6 +820,10 @@
prBssInfo = GET_BSS_INFO_BY_INDEX(prAdapter, prMsduInfo->ucBssIndex);
prStaRec = QM_GET_STA_REC_PTR_FROM_INDEX(prAdapter, prMsduInfo->ucStaRecIndex);
+ if (!prStaRec) {
+ DBGLOG(QM, ERROR, "prStaRec is null.\n");
+ return NULL;
+ }
if (prMsduInfo->ucUserPriority < 8) {
QM_DBG_CNT_INC(&prAdapter->rQM, prMsduInfo->ucUserPriority + 15);
/* QM_DBG_CNT_15 *//* QM_DBG_CNT_16 *//* QM_DBG_CNT_17 *//* QM_DBG_CNT_18 */
@@ -857,6 +861,11 @@
} while (fgCheckACMAgain);
+ if (ucQueIdx >= NUM_OF_PER_STA_TX_QUEUES) {
+ DBGLOG(QM, ERROR,
+ "ucQueIdx = %u, needs 0~3 to avoid out-of-bounds.\n", ucQueIdx);
+ return NULL;
+ }
if (prStaRec->fgIsTxAllowed) {
/* non protected BSS or protected BSS with key set */
prTxQue = prStaRec->aprTargetQueue[ucQueIdx];
@@ -4638,7 +4647,7 @@
/* 4 <3> Queue, if BSS is absent, drop probe response */
if (prBssInfo->fgIsNetAbsent) {
- if (isProbeResponse(prMsduInfo)) {
+ if (prMsduInfo && isProbeResponse(prMsduInfo)) {
DBGLOG(TX, TRACE, "Drop probe response (BSS[%u] Absent)\n",
prBssInfo->ucBssIndex);
