diff mbox

[U-Boot,1/1] env: avoid possible NULL pointer access

Message ID 20170508182354.24180-1-xypron.glpk@gmx.de
State Accepted
Commit 902f5bcfbcbc8dce964a69e4c9fcf658dfb62998
Delegated to: Tom Rini
Headers show

Commit Message

Heinrich Schuchardt May 8, 2017, 6:23 p.m. UTC 
env_attr_lookup call env_attr_walk with
callback = regex_callback.

In env_attr_walk
attributes = strchr(entry_cpy, ENV_ATTR_SEP)
will return NULL if ENV_ATTR_SEP is not found.

In the aftermath regex_callback may call
strlen(attributes)
with a NULL value which will lead to a failure.

The problem was indicated by scan-clam.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 common/env_attr.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Tom Rini May 12, 2017, 5:21 p.m. UTC | #1 
On Mon, May 08, 2017 at 08:23:54PM +0200, xypron.glpk@gmx.de wrote:

> env_attr_lookup call env_attr_walk with
> callback = regex_callback.
> 
> In env_attr_walk
> attributes = strchr(entry_cpy, ENV_ATTR_SEP)
> will return NULL if ENV_ATTR_SEP is not found.
> 
> In the aftermath regex_callback may call
> strlen(attributes)
> with a NULL value which will lead to a failure.
> 
> The problem was indicated by scan-clam.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

Applied to u-boot/master, thanks!
diff mbox

Patch

diff --git a/common/env_attr.c b/common/env_attr.c
index 5bfe5e3a89..68843f2e0f 100644
--- a/common/env_attr.c
+++ b/common/env_attr.c
@@ -132,6 +132,10 @@  static int regex_callback(const char *name, const char *attributes, void *priv)
 		if (slre_match(&slre, cbp->searched_for,
 			       strlen(cbp->searched_for), caps)) {
 			free(cbp->regex);
+			if (!attributes) {
+				retval = -EINVAL;
+				goto done;
+			}
 			cbp->regex = malloc(strlen(regex) + 1);
 			if (cbp->regex) {
 				strcpy(cbp->regex, regex);