[PATCH v2 03/12] P2PS: Add channel policy to PD Request

[Jouni Malinen]

On Thu, Oct 08, 2015 at 12:35:58PM +0300, Ilan Peer wrote:

> diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
> @@ -40,21 +40,30 @@ static void p2p_build_wps_ie_config_methods(struct wpabuf *buf,
> -static void p2ps_add_new_group_info(struct p2p_data *p2p, struct wpabuf *buf)
> +static void p2ps_add_new_group_info(struct p2p_data *p2p,
> +				    struct p2p_device *dev,
> +				    struct wpabuf *buf)

> +			p2p_prepare_channel(p2p, dev, force_freq, 0, 0);

p2p_prepare_channel() dereferences the dev argument unconditionally..

> @@ -328,7 +330,7 @@ static struct wpabuf * p2p_build_prov_disc_resp(struct p2p_data *p2p,
>  		}
>  
>  		if (!persist && (prov->conncap & P2PS_SETUP_GROUP_OWNER))
> -			p2ps_add_new_group_info(p2p, buf);
> +			p2ps_add_new_group_info(p2p, dev, buf);

Doesn't this add the exact same issue that was fixed in patch 1/12 for
the get_persistent_group() call just above this location? dev can be
NULL here..

It looks like most of p2ps_add_new_group_info() is still fine with dev
== NULL, so I'll just add a dev != NULL condition on that
p2p_prepare_channel() call.

-- 
Jouni Malinen                                            PGP id EFC895FA