espressif/esp-nimble
1
0
Fork 0
mirror of https://github.com/espressif/esp-nimble.git synced 2026-10-31 09:36:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

nimble/l2cap: Fix possible NULL pointer dereference

Browse Source 
os_mbuf_free expects valid pointer which could result in dereferencing
NULL pointer if ble_hs_mbuf_l2cap_pkt failed.

X-Original-Commit: 1c49145107cc8d320977f0ed7a155a2edd7ab5db
This commit is contained in:
Szymon Janc
2017-01-30 16:33:47 +01:00
parent 70180970af
commit cec87c62e2
1 changed files with 3 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nimble/host/src/ble_l2cap_sig_cmd.c
+3 -9
View File
@@ -27,21 +27,19 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len,
struct ble_l2cap_sig_hdr hdr;
struct os_mbuf *txom;
void *v;
int rc;
*out_om = NULL;
*out_payload_buf = NULL;
txom = ble_hs_mbuf_l2cap_pkt();
if (txom == NULL) {
rc = BLE_HS_ENOMEM;
goto err;
return BLE_HS_ENOMEM;
}
v = os_mbuf_extend(txom, BLE_L2CAP_SIG_HDR_SZ + payload_len);
if (v == NULL) {
rc = BLE_HS_ENOMEM;
goto err;
os_mbuf_free(txom);
return BLE_HS_ENOMEM;
}
hdr.op = op;
@@ -54,10 +52,6 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len,
*out_payload_buf = (uint8_t *)v + BLE_L2CAP_SIG_HDR_SZ;
return 0;
err:
os_mbuf_free(txom);
return rc;
}
static int