commit 9ea1edd140f737e15e0b2ada20c0d8cde599cc21
author James Zmuda <jzmuda@qca.qualcomm.com> Thu Apr 18 18:20:54 2013 -0700
committer Gopichand Nakkala <gnakkala@qca.qualcomm.com> Wed Apr 24 22:16:53 2013 -0700
tree d15517e25fac5ce6b6eaf2da335246447ec51e4c
parent 8c9e99ffb85fe78f8e739e7b4f37cc143496d05f

wlan: clear ChannelList everywhere it is freed

In csrNeighborRoamPerformBgScan() we are seeing invalid
dereferences of the ChannelList array. To insure that
uninitialized values of ChannelList array are never
mistakenly dereferenced we need to insure that the
ChannelList pointer is cleared everywhere that ChannelList
is freed.
CRs-Fixed: 475814

Change-Id: I98bf58dfff9eeaff8344445b78f126cb2a17e3b1

CORE/SME/src/csr/csrApiScan.c

diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 83bbb66..b00eff6 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -835,6 +835,7 @@
                         status = csrScanCopyRequest(pMac, &p11dScanCmd->u.scanCmd.u.scanRequest, &scanReq);
                         //Free the channel list
                         palFreeMemory( pMac->hHdd, pChnInfo->ChannelList );
+                        pChnInfo->ChannelList = NULL;
 
                         if (HAL_STATUS_SUCCESS(status))
                         {
@@ -3959,6 +3960,7 @@
             if(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList)
             {
                 palFreeMemory(pMac->hHdd, pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList); 
+                pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
             }
             if(HAL_STATUS_SUCCESS(palAllocateMemory(pMac->hHdd, (void **)&pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList, cChannels)))
             {
@@ -5269,6 +5271,7 @@
                 {
                     //pChannel points to the channellist from the command, free it.
                     vos_mem_free(pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList);
+                    pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = NULL;
                 }
                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels = j;
                 pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList = newChannelInfo.ChannelList;