Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-24 21:54:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

cmd: mtdparts: fix null pointer dereference in parse_mtdparts

Browse source 
In case there is no mtdparts variable in relocated environment,
NULL is assigned to p, which is later fed to strncpy.
Also function parameter mtdparts is completely ignored, so use it
in case mtdparts variable is not found in environment. This
parameter is checked not to be NULL in caller.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
This commit is contained in:
Ladislav Michl 2016-07-12 20:28:23 +02:00 committed by Tom Rini
parent c0ac333947
commit 06a040a31b
1 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
cmd/mtdparts.c
View file

@ -1524,7 +1524,7 @@ static int spread_partitions(void)
*/
static int parse_mtdparts(const char *const mtdparts)
{
const char *p = mtdparts;
const char *p;
struct mtd_device *dev;
int err = 1;
char tmp_parts[MTDPARTS_MAXLEN];
@ -1538,20 +1538,25 @@ static int parse_mtdparts(const char *const mtdparts)
}
/* re-read 'mtdparts' variable, mtd_devices_init may be updating env */
if (gd->flags & GD_FLG_ENV_READY) {
if (gd->flags & GD_FLG_ENV_READY)
p = getenv("mtdparts");
} else {
p = tmp_parts;
getenv_f("mtdparts", tmp_parts, MTDPARTS_MAXLEN);
else {
if (getenv_f("mtdparts", tmp_parts, MTDPARTS_MAXLEN) != -1)
p = tmp_parts;
else
p = NULL;
}
if (!p)
p = mtdparts;
if (strncmp(p, "mtdparts=", 9) != 0) {
printf("mtdparts variable doesn't start with 'mtdparts='\n");
return err;
}
p += 9;
while (p && (*p != '\0')) {
while (*p != '\0') {
err = 1;
if ((device_parse(p, &p, &dev) != 0) || (!dev))
break;
@ -1569,12 +1574,10 @@ static int parse_mtdparts(const char *const mtdparts)
list_add_tail(&dev->link, &devices);
err = 0;
}
if (err == 1) {
if (err == 1)
device_delall(&devices);
return 1;
}
return 0;
return err;
}
/**