From bb8fda26547b1e72d94deacc548b490e139cf9c7 Mon Sep 17 00:00:00 2001
From: YanBiao Hao <haoyanbiao@xiaomi.com>
Date: Wed, 8 Dec 2021 20:00:19 +0800
Subject: [PATCH] bluetooth: mesh : fix relay get param check

check relay get param before use, check
relay status param before use

Signed-off-by: YanBiao Hao <haoyanbiao@xiaomi.com>
---
 subsys/bluetooth/mesh/cfg_cli.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/subsys/bluetooth/mesh/cfg_cli.c b/subsys/bluetooth/mesh/cfg_cli.c
index be13d15635b..8ff60cd22c8 100644
--- a/subsys/bluetooth/mesh/cfg_cli.c
+++ b/subsys/bluetooth/mesh/cfg_cli.c
@@ -188,9 +188,13 @@ static int relay_status(struct bt_mesh_model *model,
 
 	if (bt_mesh_msg_ack_ctx_match(&cli->ack_ctx, OP_RELAY_STATUS, ctx->addr,
 				      (void **)&param)) {
+		if (param->status) {
+			*param->status = status;
+		}
 
-		*param->status = status;
-		*param->transmit = transmit;
+		if (param->transmit) {
+			*param->transmit = transmit;
+		}
 
 		bt_mesh_msg_ack_ctx_rx(&cli->ack_ctx);
 	}
@@ -1143,6 +1147,10 @@ int bt_mesh_cfg_relay_get(uint16_t net_idx, uint16_t addr, uint8_t *status,
 	};
 	int err;
 
+	if (!status || !transmit) {
+		return -EINVAL;
+	}
+
 	err = cli_prepare(&param, OP_RELAY_STATUS, addr);
 	if (err) {
 		return err;