| Message ID | 20201123170102.29502-1-michael.adler@siemens.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | libconfig parser: fix incorrect type cast | expand |
Hi Michael, On 23.11.20 18:01, Michael Adler wrote: > The function `get_value_libconfig` contains an incorrect type cast > when parsing booleans which results in overriding other memory. > > The bug can be triggered by having an sw-description like this: > > ``` > bootloader_transaction_marker = false; > > [...] > > foo = { > bar: { > [...] > } > }; > ``` > > and using SWUpdate's selection mechanism (`-e foo,bar`). > > The selection mechanism will *not* work when sw-description contains > `bootloader_transaction_marker`. > > The reason is that the value of `bootloader_transaction_marker` is > stored in the struct `swupdate_cfg` which contains the fields: > > ``` > bool bootloader_transaction_marker; > char software_set[SWUPDATE_GENERAL_STRING_SIZE]; > ``` > > The incorrect type cast (`int` instead of `bool`) results in overriding > the value stored in the `software_set` and consequently breaks the > software selection mechanism. > > Signed-off-by: Michael Adler <michael.adler@siemens.com> > Signed-off-by: Christian Storm <christian.storm@siemens.com> > --- > corelib/parsing_library_libconfig.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/corelib/parsing_library_libconfig.c b/corelib/parsing_library_libconfig.c > index 4cd3da2..42685c1 100644 > --- a/corelib/parsing_library_libconfig.c > +++ b/corelib/parsing_library_libconfig.c > @@ -34,7 +34,7 @@ void get_value_libconfig(const config_setting_t *e, void *dest) > dest = (void *)config_setting_get_string(e); > break; > case CONFIG_TYPE_BOOL: > - *(int *)dest = config_setting_get_bool(e); > + *(bool *)dest = config_setting_get_bool(e); > break; > case CONFIG_TYPE_FLOAT: > *(double *)dest = config_setting_get_float(e); > Thanks for fixing this ! Reviewed-by: Stefano Babic <sbabic@denx.de> Best regards, Stefano Babic
diff --git a/corelib/parsing_library_libconfig.c b/corelib/parsing_library_libconfig.c index 4cd3da2..42685c1 100644 --- a/corelib/parsing_library_libconfig.c +++ b/corelib/parsing_library_libconfig.c @@ -34,7 +34,7 @@ void get_value_libconfig(const config_setting_t *e, void *dest) dest = (void *)config_setting_get_string(e); break; case CONFIG_TYPE_BOOL: - *(int *)dest = config_setting_get_bool(e); + *(bool *)dest = config_setting_get_bool(e); break; case CONFIG_TYPE_FLOAT: *(double *)dest = config_setting_get_float(e);
The function `get_value_libconfig` contains an incorrect type cast when parsing booleans which results in overriding other memory. The bug can be triggered by having an sw-description like this: ``` bootloader_transaction_marker = false; [...] foo = { bar: { [...] } }; ``` and using SWUpdate's selection mechanism (`-e foo,bar`). The selection mechanism will *not* work when sw-description contains `bootloader_transaction_marker`. The reason is that the value of `bootloader_transaction_marker` is stored in the struct `swupdate_cfg` which contains the fields: ``` bool bootloader_transaction_marker; char software_set[SWUPDATE_GENERAL_STRING_SIZE]; ``` The incorrect type cast (`int` instead of `bool`) results in overriding the value stored in the `software_set` and consequently breaks the software selection mechanism. Signed-off-by: Michael Adler <michael.adler@siemens.com> Signed-off-by: Christian Storm <christian.storm@siemens.com> --- corelib/parsing_library_libconfig.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)