Skip to content

Commit f1c27b6

Browse files
moonlight83340danieldegrasse
authored andcommitted
drivers: counter: Fix possible null pointer dereference
The function counter_rz_gtm_set_alarm was accessing alarm_cfg->flags and alarm_cfg->ticks before verifying that alarm_cfg is non-NULL. This could lead to undefined behavior or crashes if a NULL pointer is passed. The pointer check has been moved before any dereference to fix this bug. Signed-off-by: Gaetan Perrot <[email protected]>
1 parent 80df24e commit f1c27b6

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

drivers/counter/counter_renesas_rz_gtm.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,8 @@ static int counter_rz_gtm_set_alarm(const struct device *dev, uint8_t chan,
190190
const struct counter_rz_gtm_config *cfg = dev->config;
191191
struct counter_rz_gtm_data *data = dev->data;
192192

193-
bool absolute = alarm_cfg->flags & COUNTER_ALARM_CFG_ABSOLUTE;
194-
uint32_t val = alarm_cfg->ticks;
193+
bool absolute;
194+
uint32_t val;
195195
k_spinlock_key_t key;
196196
bool irq_on_late;
197197
uint32_t max_rel_val;
@@ -201,6 +201,10 @@ static int counter_rz_gtm_set_alarm(const struct device *dev, uint8_t chan,
201201
if (!alarm_cfg) {
202202
return -EINVAL;
203203
}
204+
205+
absolute = alarm_cfg->flags & COUNTER_ALARM_CFG_ABSOLUTE;
206+
val = alarm_cfg->ticks;
207+
204208
/* Alarm callback is mandatory */
205209
if (!alarm_cfg->callback) {
206210
return -EINVAL;

0 commit comments

Comments
 (0)