Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-30 16:35:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

efi_loader: illegal free in EFI_LOAD_FILE2_PROTOCOL

Browse source 
strsep() changes the address that its first argument points to.
We cannot use the changed address as argument of free().

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Heinrich Schuchardt 2020-10-03 12:50:52 +02:00
parent 5cd28e1760
commit e2aff337ed
1 changed files with 9 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
lib/efi_loader/efi_load_initrd.c
View file

@ -98,19 +98,20 @@ efi_load_file2_initrd(struct efi_load_file_protocol *this,
struct efi_device_path *file_path, bool boot_policy, struct efi_device_path *file_path, bool boot_policy,
efi_uintn_t *buffer_size, void *buffer) efi_uintn_t *buffer_size, void *buffer)
{ {
const char *filespec = CONFIG_EFI_INITRD_FILESPEC; char *filespec;
efi_status_t status = EFI_NOT_FOUND; efi_status_t status = EFI_NOT_FOUND;
loff_t file_sz = 0, read_sz = 0; loff_t file_sz = 0, read_sz = 0;
char *dev, *part, *file; char *dev, *part, *file;
char *s; char *pos;
int ret; int ret;
EFI_ENTRY("%p, %p, %d, %p, %p", this, file_path, boot_policy, EFI_ENTRY("%p, %p, %d, %p, %p", this, file_path, boot_policy,
buffer_size, buffer); buffer_size, buffer);
s = strdup(filespec); filespec = strdup(CONFIG_EFI_INITRD_FILESPEC);
if (!s) if (!filespec)
goto out; goto out;
pos = filespec;
if (!this || this != &efi_lf2_protocol || if (!this || this != &efi_lf2_protocol ||
!buffer_size) { !buffer_size) {
@ -136,13 +137,13 @@ efi_load_file2_initrd(struct efi_load_file_protocol *this,
* * a device and partition identifier, e.g. "0:1" * * a device and partition identifier, e.g. "0:1"
* * a file path on the block device, e.g. "/boot/initrd.cpio.gz" * * a file path on the block device, e.g. "/boot/initrd.cpio.gz"
*/ */
dev = strsep(&s, " "); dev = strsep(&pos, " ");
if (!dev) if (!dev)
goto out; goto out;
part = strsep(&s, " "); part = strsep(&pos, " ");
if (!part) if (!part)
goto out; goto out;
file = strsep(&s, " "); file = strsep(&pos, " ");
if (!file) if (!file)
goto out; goto out;
@ -170,7 +171,7 @@ efi_load_file2_initrd(struct efi_load_file_protocol *this,
} }
out: out:
free(s); free(filespec);
return EFI_EXIT(status); return EFI_EXIT(status);
} }