[FOSS_TLK]kernel: ote: Coverity fixes
Aaron Gamble [Tue, 3 Feb 2015 19:09:39 +0000 (11:09 -0800)]
Fix NULL dereference when out of memory
Coverity id : 28174

Fix NULL dereference when passed bad parameters to te_copyin_ta_params
Coverity id : 28087

Change-Id: I1cef0039828715b7df256def704261d0b974a5b1
Reviewed-on: http://git-master/r/715778
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>
Tested-by: Varun Wadekar <vwadekar@nvidia.com>

kernel/ote_intf.c

index a709012..d9cf56e 100644 (file)
@@ -354,6 +354,13 @@ static te_error_t te_copyin_ta_params(te_request_t *req, struct te_command *cmd)
 
        in_param = (te_oper_param_t *)(uintptr_t)req->params;
        for (i = 0; i < req->params_size; i++) {
+               if (!in_param) {
+                       dprintf(CRITICAL, "%s: NULL in_param at index %d\n",
+                                       __func__, i);
+                       free(out_params);
+                       return OTE_ERROR_BAD_PARAMETERS;
+               }
+
                memcpy(&out_params[i], in_param, sizeof(*out_params));
 
                switch (out_params[i].type) {
@@ -595,10 +602,11 @@ te_error_t te_handle_open_session(te_request_t *req, bool task_issued)
        result = OTE_SUCCESS;
 exit:
        if (result != OTE_SUCCESS) {
-               if (cmd->msg.params)
-                       free((void *)(uintptr_t)cmd->msg.params);
-               if (cmd)
+               if (cmd) {
+                       if (cmd->msg.params)
+                               free((void *)(uintptr_t)cmd->msg.params);
                        free(cmd);
+               }
                if (session)
                        free(session);
        }