wext: handle NULL extra data in iwe_stream_add_point better
authorArnd Bergmann <arnd@arndb.de>
Wed, 11 Jan 2017 14:35:25 +0000 (15:35 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Thu, 12 Jan 2017 09:15:00 +0000 (10:15 +0100)
gcc-7 complains that wl3501_cs passes NULL into a function that
then uses the argument as the input for memcpy:

drivers/net/wireless/wl3501_cs.c: In function 'wl3501_get_scan':
include/net/iw_handler.h:559:3: error: argument 2 null where non-null expected [-Werror=nonnull]
   memcpy(stream + point_len, extra, iwe->u.data.length);

This works fine here because iwe->u.data.length is guaranteed to be 0
and the memcpy doesn't actually have an effect.

Making the length check explicit avoids the warning and should have
no other effect here.

Also check the pointer itself, since otherwise we get warnings
elsewhere in the code.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
include/net/iw_handler.h

index e0f4109e64c6fca9ba87d768c2c7b1220a6557f4..c2aa73e5e6bb7282e57ead8397828d3b98b5ddd2 100644 (file)
@@ -556,7 +556,8 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends,
                memcpy(stream + lcp_len,
                       ((char *) &iwe->u) + IW_EV_POINT_OFF,
                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-               memcpy(stream + point_len, extra, iwe->u.data.length);
+               if (iwe->u.data.length && extra)
+                       memcpy(stream + point_len, extra, iwe->u.data.length);
                stream += event_len;
        }
        return stream;