Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2221001/?format=api
{ "id": 2221001, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2221001/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/patch/20260408140339.798015-1-aristo.chen@canonical.com/", "project": { "id": 18, "url": "http://patchwork.ozlabs.org/api/1.2/projects/18/?format=api", "name": "U-Boot", "link_name": "uboot", "list_id": "u-boot.lists.denx.de", "list_email": "u-boot@lists.denx.de", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260408140339.798015-1-aristo.chen@canonical.com>", "list_archive_url": null, "date": "2026-04-08T14:03:35", "name": "[v1,1/2] lib: hashtable: fix integer overflow in himport_r", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "7e27eb615e4de82f2825c730c1c6bb1611557518", "submitter": { "id": 92721, "url": "http://patchwork.ozlabs.org/api/1.2/people/92721/?format=api", "name": "Aristo Chen", "email": "aristo.chen@canonical.com" }, "delegate": { "id": 3651, "url": "http://patchwork.ozlabs.org/api/1.2/users/3651/?format=api", "username": "trini", "first_name": "Tom", "last_name": "Rini", "email": "trini@ti.com" }, "mbox": "http://patchwork.ozlabs.org/project/uboot/patch/20260408140339.798015-1-aristo.chen@canonical.com/mbox/", "series": [ { "id": 499162, "url": "http://patchwork.ozlabs.org/api/1.2/series/499162/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/list/?series=499162", "date": "2026-04-08T14:03:35", "name": "[v1,1/2] lib: hashtable: fix integer overflow in himport_r", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499162/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2221001/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2221001/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<u-boot-bounces@lists.denx.de>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=NrOPoWNZ;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=85.214.62.61; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)", "phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=canonical.com", "phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de", "phobos.denx.de;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.b=\"NrOPoWNZ\";\n\tdkim-atps=neutral", "phobos.denx.de; dmarc=pass (p=reject dis=none)\n header.from=canonical.com", "phobos.denx.de;\n spf=pass smtp.mailfrom=aristo.chen@canonical.com" ], "Received": [ "from phobos.denx.de (phobos.denx.de [85.214.62.61])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frTmw47nLz1yD3\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 09 Apr 2026 02:59:12 +1000 (AEST)", "from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id B7BD283D8A;\n\tWed, 8 Apr 2026 18:59:08 +0200 (CEST)", "by phobos.denx.de (Postfix, from userid 109)\n id F17A38407E; Wed, 8 Apr 2026 16:04:31 +0200 (CEST)", "from smtp-relay-internal-0.canonical.com\n (smtp-relay-internal-0.canonical.com [185.125.188.122])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 004198407E\n for <u-boot@lists.denx.de>; Wed, 8 Apr 2026 16:04:29 +0200 (CEST)", "from mail-pl1-f200.google.com (mail-pl1-f200.google.com\n [209.85.214.200])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 8D5613F665\n for <u-boot@lists.denx.de>; Wed, 8 Apr 2026 14:04:29 +0000 (UTC)", "by mail-pl1-f200.google.com with SMTP id\n d9443c01a7336-2b0c30b51bfso131743505ad.0\n for <u-boot@lists.denx.de>; Wed, 08 Apr 2026 07:04:29 -0700 (PDT)", "from noble-uboot.lxd (124-218-37-86.cm.dynamic.apol.com.tw.\n [124.218.37.86]) by smtp.gmail.com with ESMTPSA id\n d9443c01a7336-2b2749a3af9sm194312545ad.63.2026.04.08.07.04.24\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 08 Apr 2026 07:04:26 -0700 (PDT)" ], "X-Spam-Checker-Version": "SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de", "X-Spam-Level": "", "X-Spam-Status": "No, score=-2.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,\n DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,\n RCVD_IN_DNSWL_BLOCKED,RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,\n RCVD_IN_VALIDITY_RPBL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775657069;\n bh=xvEdXS101iGPdq8D/tueyGV9esPvRRU3a73RwdsCb5Y=;\n h=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=NrOPoWNZ+yAZmBCNzN+H+A0/g7wGUsCrn6H4PSGtfE5PpwMl7JaAslPm978kzWQlD\n GMc43aaWEC0o4/rwG0znsSNdL/Mdzod419TIGbFkwDSWRKqvQiRuGMSCxkO4lEQXgx\n osef+X68AXUsbrpKM9/oO8cBPL/x/p2ULHsLEK+j7vvHfeR9aKAVeYnrrsbjVb62in\n riiCAJ6BId4/xqOckvJJl1ecynWG6K7oJcEabix+kO3QeUeREIURl8rcs2KftLWkiU\n gtt7hTLBfi1LuhGQkcG6KCBWAw9nzWkYZpGEnzb1Q5CHMjrBbjQFSIqeaUIvgIgJvx\n qpuVKw+7Rc6/jWL82Vonve0r4BzmMOpCpggo6pdbN/5jA5k5R/ZlBBb+osRtNEY0iI\n RMWMta348gtQcyXyxsc0rliaEmdt0cuM+qckgDKfLVFMiA0H2hBTppqqwSjrZ1A9v/\n dPtUX0xrh3jYcx+UKULygyc9NzEBkllNDbNiW7mTf2iKz+HgziCK8+LgZamYTNdqSN\n piHjjkAcjBnvjdNYS4kzOWyDPz5uTj01Js/UkGY9yUWs/SltnZBIPPxybpchk6sbwm\n 1X//nUCedDxHt34jiOT0AwfP/G70FmjmO/cxIg+lND92j16m5tw03RSdCuIBmYs3La\n ku6uHv61Q3WNplTk1go3nZxM=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775657067; x=1776261867;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=xvEdXS101iGPdq8D/tueyGV9esPvRRU3a73RwdsCb5Y=;\n b=UuZO7sUt90DAYLCYGVBv9bLlyNG/ewgkm1Y3g3L8tL21s+Fu+cJ4VWccUhhfgWgGff\n SqZukA9fwqTpBfK16fLYwp+FkWm0bY5QjPo3X2YIux4RvNBJCxOKakSYFtVc0RW6VWjF\n uXhUui2BfAhn0d0yUqhpq5BeqnGC1XzHRQOOCFWbWa+hcQ84K7J20ZsKkSeYjp0dcClH\n PzzvfOVQxSAN6wpGw5DXWxr6cEpT6QEffoYjprvWUm/SCFG6nWTMcaM8WpiWRdqnbEn9\n U8qu6hb1ckShe5o7qzpejKyWsEy8JmPLqjir5eWYhJz0RT5rVFVib4MAU5guLRezb/L7\n C1Ig==", "X-Gm-Message-State": "AOJu0Yx2e0UPlCULP/losBVSO/tc8sOXw/xEHQ+MtblpTUM9zg81sryz\n 9ioH0+AFcskR7GcRopMJn/f0g3am2WBsL/tf9TUzQim3Y8dtLPrWddECrYX7rVPZw/ygFiB1DM9\n Z5iJ/tdcb6ijsrjKOi+XXmLeMrRSl86Tg+6WU327xK4payKoUjLaObg0otRYa9CUFwnap105GJd\n WALglqIg==", "X-Gm-Gg": "AeBDieu6CNYUSWFT85DTYG67ZQJ6WV+oePu5ErjyY4pkGiJx83Rh7PaW9Xm3PZF3TrW\n Hyi94OAa4ZoOc0Lk5oY3ELqP0m+xfp6X61sHPi2axr+k6YtxWY1gIWYlK81aH/lmMe6IFazMprJ\n 6+cIcNZtBCUv7GgD0oTlfDnGojFf+hfkWhxXS4JchwAL+s+X4dNlkQUIUSmJKnRvCrd5SsTl6cP\n C33ji/0WjPoGBTNwh/OaEJXQ+OPOS/so4ll/E4RmbQWDMCKnH8PLUKbpHOIHw8Tm67s4EI5p86Q\n oNVuGbYzFJ3+s4ibM1+d+7XPqddeDn/dGgKIVNlDY7ffwc+wfLs+vd9a1n/lZf4Z2RxHlypnlNh\n wM7AMqn4zBtNimrF/AK+zeb+6FoqACBGWT/9LyJFTu0fIF/FI9o2qnFQ8gTGMgMveLSpG3B/C", "X-Received": [ "by 2002:a17:903:17cb:b0:2b2:4029:d781 with SMTP id\n d9443c01a7336-2b28175e05amr236727795ad.20.1775657067419;\n Wed, 08 Apr 2026 07:04:27 -0700 (PDT)", "by 2002:a17:903:17cb:b0:2b2:4029:d781 with SMTP id\n d9443c01a7336-2b28175e05amr236727415ad.20.1775657067067;\n Wed, 08 Apr 2026 07:04:27 -0700 (PDT)" ], "From": "Aristo Chen <aristo.chen@canonical.com>", "To": "u-boot@lists.denx.de", "Cc": "Aristo Chen <aristo.chen@canonical.com>,\n\tTom Rini <trini@konsulko.com>", "Subject": "[PATCH v1 1/2] lib: hashtable: fix integer overflow in himport_r", "Date": "Wed, 8 Apr 2026 14:03:35 +0000", "Message-ID": "<20260408140339.798015-1-aristo.chen@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-Mailman-Approved-At": "Wed, 08 Apr 2026 18:59:06 +0200", "X-BeenThere": "u-boot@lists.denx.de", "X-Mailman-Version": "2.1.39", "Precedence": "list", "List-Id": "U-Boot discussion <u-boot.lists.denx.de>", "List-Unsubscribe": "<https://lists.denx.de/options/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>", "List-Archive": "<https://lists.denx.de/pipermail/u-boot/>", "List-Post": "<mailto:u-boot@lists.denx.de>", "List-Help": "<mailto:u-boot-request@lists.denx.de?subject=help>", "List-Subscribe": "<https://lists.denx.de/listinfo/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=subscribe>", "Errors-To": "u-boot-bounces@lists.denx.de", "Sender": "\"U-Boot\" <u-boot-bounces@lists.denx.de>", "X-Virus-Scanned": "clamav-milter 0.103.8 at phobos.denx.de", "X-Virus-Status": "Clean" }, "content": "When size == SIZE_MAX, the expression malloc(size + 1) wraps to\nmalloc(0) due to unsigned integer overflow. malloc(0) may return a\nnon-NULL pointer, causing the subsequent memcpy(data, env, size) to\nwrite SIZE_MAX bytes into a zero-byte allocation.\n\nThis is reachable from the U-Boot console via \"env import\", where size\nis taken directly from a user-supplied hex argument.\n\nAdd an explicit check for SIZE_MAX before the malloc call and return\nEINVAL.\n\nSigned-off-by: Aristo Chen <aristo.chen@canonical.com>\n---\n lib/hashtable.c | 7 +++++++\n 1 file changed, 7 insertions(+)", "diff": "diff --git a/lib/hashtable.c b/lib/hashtable.c\nindex 75c263b5053..902fa6f3e98 100644\n--- a/lib/hashtable.c\n+++ b/lib/hashtable.c\n@@ -820,6 +820,13 @@ int himport_r(struct hsearch_data *htab,\n \t\treturn 0;\n \t}\n \n+\t/* Check for potential integer overflow */\n+\tif (size == SIZE_MAX) {\n+\t\tdebug(\"%s: size too large, would overflow\\n\", __func__);\n+\t\t__set_errno(EINVAL);\n+\t\treturn 0;\n+\t}\n+\n \t/* we allocate new space to make sure we can write to the array */\n \tif ((data = malloc(size + 1)) == NULL) {\n \t\tdebug(\"himport_r: can't malloc %lu bytes\\n\", (ulong)size + 1);\n", "prefixes": [ "v1", "1/2" ] }