From patchwork Fri Apr 20 13:29:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Dahl X-Patchwork-Id: 901924 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=thorsis.com Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 40SH0g4dQMz9s1s for ; Fri, 20 Apr 2018 23:35:15 +1000 (AEST) Received: by lists.denx.de (Postfix, from userid 105) id 01732C21E1D; Fri, 20 Apr 2018 13:35:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=RCVD_IN_DNSWL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 8D8ADC21E07; Fri, 20 Apr 2018 13:34:45 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 46932C21C57; Fri, 20 Apr 2018 13:29:33 +0000 (UTC) Received: from mail.thorsis.com (mail.thorsis.com [92.198.35.195]) by lists.denx.de (Postfix) with ESMTPS id EE1C9C21C57 for ; Fri, 20 Apr 2018 13:29:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.thorsis.com (Postfix) with ESMTP id D63183A46FD for ; Fri, 20 Apr 2018 15:29:37 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at mail.thorsis.com Received: from mail.thorsis.com ([127.0.0.1]) by localhost (mail.thorsis.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p36aR_KkGzgL for ; Fri, 20 Apr 2018 15:29:37 +0200 (CEST) Received: from adahl by ada.ifak-system.com with local (Exim 4.89) (envelope-from ) id 1f9W6V-0005ne-CP for u-boot@lists.denx.de; Fri, 20 Apr 2018 15:29:31 +0200 From: Alexander Dahl To: u-boot@lists.denx.de Date: Fri, 20 Apr 2018 15:29:31 +0200 Message-Id: <20180420132931.22250-3-ada@thorsis.com> In-Reply-To: <20180420132931.22250-1-ada@thorsis.com> References: <20180420132931.22250-1-ada@thorsis.com> X-Mailman-Approved-At: Fri, 20 Apr 2018 13:34:44 +0000 Subject: [U-Boot] [PATCH 2/2] tools: mkenvimage: Fix possible segfault on stdin input X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" The size of 'filebuf' was not increased as more and more bytes are read from stdin, but 'filebuf' was always reallocated to the same fix size. This works as long as only less bytes than the initial buffer size come in, for more input this will segfault. (It actually does, I tested that.) So for each loop cycle the buffer size has to be increased by the number of bytes we want to read. Signed-off-by: Alexander Dahl --- tools/mkenvimage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/mkenvimage.c b/tools/mkenvimage.c index 716cb73a5c..8cd9ffa1c6 100644 --- a/tools/mkenvimage.c +++ b/tools/mkenvimage.c @@ -162,7 +162,7 @@ int main(int argc, char **argv) txt_fd = STDIN_FILENO; do { - filebuf = realloc(filebuf, readlen); + filebuf = realloc(filebuf, filesize + readlen); if (!filebuf) { fprintf(stderr, "Can't realloc memory for the input file buffer\n"); return EXIT_FAILURE;