MmRpc: Add Input Paramter Checking to APIs

This patch adds input paramter checking to the MmRpc_* APIs,
specifically checking for NULL pointers, in order to prevent
a crash due to NULL-pointer de-reference in the case that the
user sends a bad (NULL) pointer.

Signed-off-by: Angela Stegmaier <angelabaker@ti.com>

diff --git a/packages/ti/ipc/mm/MmRpc.c b/packages/ti/ipc/mm/MmRpc.c
index 09d6b05982fb0d128fd52fdb0a79b9b509da06d1..410851d63536bf2424c82556c782c41e84148111 100644 (file)
--- a/packages/ti/ipc/mm/MmRpc.c
+++ b/packages/ti/ipc/mm/MmRpc.c
@@ -116,6 +116,11 @@ int MmRpc_create(const char *service, const MmRpc_Params *params,
     MmRpc_Object *  obj;
     char            cbuf[RPPC_MAX_INST_NAMELEN+16];
 
     MmRpc_Object *  obj;
     char            cbuf[RPPC_MAX_INST_NAMELEN+16];
 

+    if (service == NULL || handlePtr == NULL) {
+        status = MmRpc_E_INVALIDPARAM;
+        goto leave;
+    }
+

     /* allocate the instance object */
     obj = (MmRpc_Object *)calloc(1, sizeof(MmRpc_Object));
 
     /* allocate the instance object */
     obj = (MmRpc_Object *)calloc(1, sizeof(MmRpc_Object));
 


@@ -154,7 +159,9 @@ leave:
         if (obj != NULL) {
             free(obj);
         }
         if (obj != NULL) {
             free(obj);
         }

-        *handlePtr = NULL;
+        if (handlePtr) {
+            *handlePtr = NULL;
+        }

     }
     else {
         *handlePtr = (MmRpc_Handle)obj;
     }
     else {
         *handlePtr = (MmRpc_Handle)obj;


@@ -171,6 +178,10 @@ int MmRpc_delete(MmRpc_Handle *handlePtr)
     int status = MmRpc_S_SUCCESS;
     MmRpc_Object *obj;
 
     int status = MmRpc_S_SUCCESS;
     MmRpc_Object *obj;
 

+    if (handlePtr == NULL) {
+        return MmRpc_E_INVALIDPARAM;
+    }
+

     obj = (MmRpc_Object *)(*handlePtr);
 
     /* close the device */
     obj = (MmRpc_Object *)(*handlePtr);
 
     /* close the device */


@@ -199,6 +210,11 @@ int MmRpc_call(MmRpc_Handle handle, MmRpc_FxnCtx *ctx, int32_t *ret)
     int len;
     int i;
 
     int len;
     int i;
 

+    if (handle == NULL || ctx == NULL || ret == NULL) {
+        status = MmRpc_E_INVALIDPARAM;
+        goto leave;
+    }
+

     /* combine params and translation array into one contiguous message */
     len = sizeof(struct rppc_function) +
                 (ctx->num_xlts * sizeof(struct rppc_param_translation));
     /* combine params and translation array into one contiguous message */
     len = sizeof(struct rppc_function) +
                 (ctx->num_xlts * sizeof(struct rppc_param_translation));


@@ -375,6 +391,11 @@ int MmRpc_bufHandle(MmRpc_Handle handle, int cmd, int num, MmRpc_BufDesc *desc)
     int i;
     struct rppc_buf_fds reg = { num, NULL };
 
     int i;
     struct rppc_buf_fds reg = { num, NULL };
 

+    if (handle == NULL || desc == NULL) {
+        stat = MmRpc_E_INVALIDPARAM;
+        goto leave;
+    }
+

     reg.fds = (int32_t *)malloc(num * sizeof(int32_t));
 
     if (reg.fds == NULL) {
     reg.fds = (int32_t *)malloc(num * sizeof(int32_t));
 
     if (reg.fds == NULL) {