diff options
author | Angela Stegmaier <angelabaker@ti.com> | 2017-07-12 16:33:09 -0500 |
---|---|---|
committer | Angela Stegmaier <angelabaker@ti.com> | 2017-08-03 11:43:59 -0500 |
commit | 6736bb2b9b060cf37d3e6728e21509b24ec12da8 (patch) | |
tree | be7ed626658bcef7cc5c83095a2a54c2df951334 | |
parent | bf355e7d0f5c3993f56a6ea778743b656ef6b536 (diff) | |
download | ipc-6736bb2b9b060cf37d3e6728e21509b24ec12da8.tar.gz |
MmRpc: Add Input Paramter Checking to APIs
This patch adds input paramter checking to the MmRpc_* APIs,
specifically checking for NULL pointers, in order to prevent
a crash due to NULL-pointer de-reference in the case that the
user sends a bad (NULL) pointer.
Signed-off-by: Angela Stegmaier <angelabaker@ti.com>
-rw-r--r-- | packages/ti/ipc/mm/MmRpc.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/packages/ti/ipc/mm/MmRpc.c b/packages/ti/ipc/mm/MmRpc.c index 09d6b05..410851d 100644 --- a/packages/ti/ipc/mm/MmRpc.c +++ b/packages/ti/ipc/mm/MmRpc.c @@ -116,6 +116,11 @@ int MmRpc_create(const char *service, const MmRpc_Params *params, MmRpc_Object * obj; char cbuf[RPPC_MAX_INST_NAMELEN+16]; + if (service == NULL || handlePtr == NULL) { + status = MmRpc_E_INVALIDPARAM; + goto leave; + } + /* allocate the instance object */ obj = (MmRpc_Object *)calloc(1, sizeof(MmRpc_Object)); @@ -154,7 +159,9 @@ leave: if (obj != NULL) { free(obj); } - *handlePtr = NULL; + if (handlePtr) { + *handlePtr = NULL; + } } else { *handlePtr = (MmRpc_Handle)obj; @@ -171,6 +178,10 @@ int MmRpc_delete(MmRpc_Handle *handlePtr) int status = MmRpc_S_SUCCESS; MmRpc_Object *obj; + if (handlePtr == NULL) { + return MmRpc_E_INVALIDPARAM; + } + obj = (MmRpc_Object *)(*handlePtr); /* close the device */ @@ -199,6 +210,11 @@ int MmRpc_call(MmRpc_Handle handle, MmRpc_FxnCtx *ctx, int32_t *ret) int len; int i; + if (handle == NULL || ctx == NULL || ret == NULL) { + status = MmRpc_E_INVALIDPARAM; + goto leave; + } + /* combine params and translation array into one contiguous message */ len = sizeof(struct rppc_function) + (ctx->num_xlts * sizeof(struct rppc_param_translation)); @@ -375,6 +391,11 @@ int MmRpc_bufHandle(MmRpc_Handle handle, int cmd, int num, MmRpc_BufDesc *desc) int i; struct rppc_buf_fds reg = { num, NULL }; + if (handle == NULL || desc == NULL) { + stat = MmRpc_E_INVALIDPARAM; + goto leave; + } + reg.fds = (int32_t *)malloc(num * sizeof(int32_t)); if (reg.fds == NULL) { |