nimble/l2cap: Fix possible NULL pointer dereference os_mbuf_free expects valid pointer which could result in dereferencing NULL pointer if ble_hs_mbuf_l2cap_pkt failed.
Project: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/repo Commit: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/commit/1c491451 Tree: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/tree/1c491451 Diff: http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/diff/1c491451 Branch: refs/heads/develop Commit: 1c49145107cc8d320977f0ed7a155a2edd7ab5db Parents: 98f2a20 Author: Szymon Janc <[email protected]> Authored: Mon Jan 30 16:33:47 2017 +0100 Committer: Szymon Janc <[email protected]> Committed: Mon Jan 30 16:33:47 2017 +0100 ---------------------------------------------------------------------- net/nimble/host/src/ble_l2cap_sig_cmd.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/incubator-mynewt-core/blob/1c491451/net/nimble/host/src/ble_l2cap_sig_cmd.c ---------------------------------------------------------------------- diff --git a/net/nimble/host/src/ble_l2cap_sig_cmd.c b/net/nimble/host/src/ble_l2cap_sig_cmd.c index b8ab12b..7458210 100644 --- a/net/nimble/host/src/ble_l2cap_sig_cmd.c +++ b/net/nimble/host/src/ble_l2cap_sig_cmd.c @@ -27,21 +27,19 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len, struct ble_l2cap_sig_hdr hdr; struct os_mbuf *txom; void *v; - int rc; *out_om = NULL; *out_payload_buf = NULL; txom = ble_hs_mbuf_l2cap_pkt(); if (txom == NULL) { - rc = BLE_HS_ENOMEM; - goto err; + return BLE_HS_ENOMEM; } v = os_mbuf_extend(txom, BLE_L2CAP_SIG_HDR_SZ + payload_len); if (v == NULL) { - rc = BLE_HS_ENOMEM; - goto err; + os_mbuf_free(txom); + return BLE_HS_ENOMEM; } hdr.op = op; @@ -54,10 +52,6 @@ ble_l2cap_sig_init_cmd(uint8_t op, uint8_t id, uint8_t payload_len, *out_payload_buf = (uint8_t *)v + BLE_L2CAP_SIG_HDR_SZ; return 0; - -err: - os_mbuf_free(txom); - return rc; } static int
