summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: bf355e7)
raw | patch | inline | side by side (parent: bf355e7)
author | Angela Stegmaier <angelabaker@ti.com> | |
Wed, 12 Jul 2017 21:33:09 +0000 (16:33 -0500) | ||
committer | Angela Stegmaier <angelabaker@ti.com> | |
Thu, 3 Aug 2017 16:43:59 +0000 (11:43 -0500) |
This patch adds input paramter checking to the MmRpc_* APIs,
specifically checking for NULL pointers, in order to prevent
a crash due to NULL-pointer de-reference in the case that the
user sends a bad (NULL) pointer.
Signed-off-by: Angela Stegmaier <angelabaker@ti.com>
specifically checking for NULL pointers, in order to prevent
a crash due to NULL-pointer de-reference in the case that the
user sends a bad (NULL) pointer.
Signed-off-by: Angela Stegmaier <angelabaker@ti.com>
packages/ti/ipc/mm/MmRpc.c | patch | blob | history |
index 09d6b05982fb0d128fd52fdb0a79b9b509da06d1..410851d63536bf2424c82556c782c41e84148111 100644 (file)
MmRpc_Object * obj;
char cbuf[RPPC_MAX_INST_NAMELEN+16];
MmRpc_Object * obj;
char cbuf[RPPC_MAX_INST_NAMELEN+16];
+ if (service == NULL || handlePtr == NULL) {
+ status = MmRpc_E_INVALIDPARAM;
+ goto leave;
+ }
+
/* allocate the instance object */
obj = (MmRpc_Object *)calloc(1, sizeof(MmRpc_Object));
/* allocate the instance object */
obj = (MmRpc_Object *)calloc(1, sizeof(MmRpc_Object));
if (obj != NULL) {
free(obj);
}
if (obj != NULL) {
free(obj);
}
- *handlePtr = NULL;
+ if (handlePtr) {
+ *handlePtr = NULL;
+ }
}
else {
*handlePtr = (MmRpc_Handle)obj;
}
else {
*handlePtr = (MmRpc_Handle)obj;
int status = MmRpc_S_SUCCESS;
MmRpc_Object *obj;
int status = MmRpc_S_SUCCESS;
MmRpc_Object *obj;
+ if (handlePtr == NULL) {
+ return MmRpc_E_INVALIDPARAM;
+ }
+
obj = (MmRpc_Object *)(*handlePtr);
/* close the device */
obj = (MmRpc_Object *)(*handlePtr);
/* close the device */
int len;
int i;
int len;
int i;
+ if (handle == NULL || ctx == NULL || ret == NULL) {
+ status = MmRpc_E_INVALIDPARAM;
+ goto leave;
+ }
+
/* combine params and translation array into one contiguous message */
len = sizeof(struct rppc_function) +
(ctx->num_xlts * sizeof(struct rppc_param_translation));
/* combine params and translation array into one contiguous message */
len = sizeof(struct rppc_function) +
(ctx->num_xlts * sizeof(struct rppc_param_translation));
@@ -375,6 +391,11 @@ int MmRpc_bufHandle(MmRpc_Handle handle, int cmd, int num, MmRpc_BufDesc *desc)
int i;
struct rppc_buf_fds reg = { num, NULL };
int i;
struct rppc_buf_fds reg = { num, NULL };
+ if (handle == NULL || desc == NULL) {
+ stat = MmRpc_E_INVALIDPARAM;
+ goto leave;
+ }
+
reg.fds = (int32_t *)malloc(num * sizeof(int32_t));
if (reg.fds == NULL) {
reg.fds = (int32_t *)malloc(num * sizeof(int32_t));
if (reg.fds == NULL) {