From cec87c62e28f9420704f4f2873ec5f1695580328 Mon Sep 17 00:00:00 2001 From: Szymon Janc Date: Mon, 30 Jan 2017 16:33:47 +0100 Subject: [PATCH] nimble/l2cap: Fix possible NULL pointer dereference os_mbuf_free expects valid pointer which could result in dereferencing NULL pointer if ble_hs_mbuf_l2cap_pkt failed. X-Original-Commit: 1c49145107cc8d320977f0ed7a155a2edd7ab5db --- nimble/host/src/ble_l2cap_sig_cmd.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/nimble/host/src/ble_l2cap_sig_cmd.c b/nimble/host/src/ble_l2cap_sig_cmd.c index b8ab12ba9..745821022 100644 --- a/nimble/host/src/ble_l2cap_sig_cmd.c +++ b/nimble/host/src/ble_l2cap_sig_cmd.c @@ -27,21 +27,19 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len, struct ble_l2cap_sig_hdr hdr; struct os_mbuf *txom; void *v; - int rc; *out_om = NULL; *out_payload_buf = NULL; txom = ble_hs_mbuf_l2cap_pkt(); if (txom == NULL) { - rc = BLE_HS_ENOMEM; - goto err; + return BLE_HS_ENOMEM; } v = os_mbuf_extend(txom, BLE_L2CAP_SIG_HDR_SZ + payload_len); if (v == NULL) { - rc = BLE_HS_ENOMEM; - goto err; + os_mbuf_free(txom); + return BLE_HS_ENOMEM; } hdr.op = op; @@ -54,10 +52,6 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len, *out_payload_buf = (uint8_t *)v + BLE_L2CAP_SIG_HDR_SZ; return 0; - -err: - os_mbuf_free(txom); - return rc; } static int