commit dbf19f6d76b959b73a59ed2433623463d59e7504
author Awk Jiang <awk.jiang@mediatek.com> Thu Mar 16 17:35:43 2017 +0800
committer Awk Jiang <awk.jiang@mediatek.com> Thu Mar 16 17:35:43 2017 +0800
tree e7466f39fef6b520256dd2caa6fd082255f069fd
parent 5ff139c0321e36d9aa5fa3eb2eebb4490719e978

[WCNCR00146539] regd: Fix some potential issues of TxPwrLimit

[Description]
Fix some potential memory issues of TxPwrLimit

In rlmDomainTxPwrLimitLoadChannelSetting()

  1. Fix incorect temp variables for capture its result.
  2. Defer the forwarding action during reading ch settingsn

In rlmDomainGetTxPwrLimit()

  1. Add memory allocation result check.
  2. Reuse ucChNum

In rlmDomainSendPwrLimitCmd_V2()

  Refine the error handling for allocating memroy.

Change-Id: I43bdd29926ba7b0a51b44ff77e2548d4ffdd66b5
Feature: regd
Signed-off-by: Awk Jiang <awk.jiang@mediatek.com>
CR-Id: WCNCR00146539

mgmt/rlm_domain.c

diff --git a/mgmt/rlm_domain.c b/mgmt/rlm_domain.c
index 1d7563d..a17dd66 100644
--- a/mgmt/rlm_domain.c
+++ b/mgmt/rlm_domain.c
@@ -1602,8 +1602,8 @@
 	char cTmpChar = 0;
 	P_CHANNEL_TX_PWR_LIMIT prChTxPwrLimit = NULL;
 	BOOL bNeg = FALSE;
-	INT_8 cLimitValue = 0;
-	UINT_8 ucIdx = 0, ucChannel = 0, cChIdx = 0;
+	INT_8 cLimitValue = 0, cChIdx = 0;
+	UINT_8 ucIdx = 0, ucChannel = 0;
 
 	/* skip blank lines */
 	while (u4TmpPos < u4BufEnd) {
@@ -1637,8 +1637,6 @@
 		return FALSE;
 	}
 
-	u4TmpPos += 5;
-
 	cChIdx = rlmDomainTxPwrLimitGetChIdx(pTxPwrLimit, ucChannel);
 
 	if (cChIdx == -1) {
@@ -1647,6 +1645,8 @@
 		return FALSE;
 	}
 
+	u4TmpPos += 5;
+
 	prChTxPwrLimit = &pTxPwrLimit->rChannelTxPwrLimit[cChIdx];
 
 	/* read the channel TxPwrLimit settings */
@@ -1828,7 +1828,8 @@
 	P_CMD_SET_COUNTRY_CHANNEL_POWER_LIMIT_V2_T pSetCmd,
 	P_TX_PWR_LIMIT_DATA pTxPwrLimit)
 {
-	UINT_8 ucIdx = 0, cChIdx = 0;
+	UINT_8 ucIdx = 0;
+	INT_8 cChIdx = 0;
 	P_CMD_CHANNEL_POWER_LIMIT_V2 pCmd = NULL;
 	P_CHANNEL_TX_PWR_LIMIT pChTxPwrLimit = NULL;
 
@@ -1903,17 +1904,24 @@
 	P_TX_PWR_LIMIT_DATA pTxPwrLimit =
 		(P_TX_PWR_LIMIT_DATA) kalMemAlloc(sizeof(TX_PWR_LIMIT_DATA), VIR_MEM_TYPE);
 
-	pTxPwrLimit->rChannelTxPwrLimit =
-		(P_CHANNEL_TX_PWR_LIMIT) kalMemAlloc(sizeof(CHANNEL_TX_PWR_LIMIT) *
-			(pSetCmd_2g->ucNum + pSetCmd_5g->ucNum), VIR_MEM_TYPE);
-
-	if (!pTxPwrLimit->rChannelTxPwrLimit) {
+	if (!pTxPwrLimit) {
 		bRet = FALSE;
-		goto error;
+		DBGLOG(RLM, ERROR, "Alloc buffer for TxPwrLimit main struct failed\n");
+		return bRet;
 	}
 
 	pTxPwrLimit->ucChNum = pSetCmd_2g->ucNum + pSetCmd_5g->ucNum;
 
+	pTxPwrLimit->rChannelTxPwrLimit =
+		(P_CHANNEL_TX_PWR_LIMIT) kalMemAlloc(sizeof(CHANNEL_TX_PWR_LIMIT) *
+			(pTxPwrLimit->ucChNum), VIR_MEM_TYPE);
+
+	if (!pTxPwrLimit->rChannelTxPwrLimit) {
+		bRet = FALSE;
+		DBGLOG(RLM, ERROR, "Alloc buffer for TxPwrLimit ch values failed\n");
+		goto error;
+	}
+
 	for (ucIdx = 0; ucIdx < pSetCmd_2g->ucNum; ucIdx++) {
 		pTxPwrLimit->rChannelTxPwrLimit[ucCnt].ucChannel =
 			pSetCmd_2g->rChannelPowerLimit[ucIdx].ucCentralCh;
@@ -2390,7 +2398,7 @@
 
 		if (!prCmd[band_idx]) {
 			DBGLOG(RLM, ERROR, "Domain: no buf to send cmd\n");
-			return;
+			goto error;
 		}
 
 		/*initialize tw pwr table*/
@@ -2445,8 +2453,12 @@
 					      NULL,	/* pvSetQueryBuffer */
 					      0	/* u4SetQueryBufferLen */
 						);
+	}
 
-		cnmMemFree(prAdapter, prCmd[band_idx]);
+error:
+	for (band_idx = 0; band_idx < IEEE80211_NUM_BANDS; band_idx++) {
+		if (prCmd[band_idx])
+			cnmMemFree(prAdapter, prCmd[band_idx]);
 	}
 #endif
 }