From patchwork Mon Feb 28 19:08:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Glass X-Patchwork-Id: 1599179 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.a=rsa-sha256 header.s=google header.b=RMmd0Mnx; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4K7Dts2fJ9z9s8q for ; Tue, 1 Mar 2022 22:05:41 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 3F1BD83C24; Mon, 28 Feb 2022 20:09:49 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="RMmd0Mnx"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 57CFD83868; Mon, 28 Feb 2022 20:09:21 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-oo1-xc36.google.com (mail-oo1-xc36.google.com [IPv6:2607:f8b0:4864:20::c36]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 68EE283868 for ; Mon, 28 Feb 2022 20:09:07 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=sjg@chromium.org Received: by mail-oo1-xc36.google.com with SMTP id r41-20020a4a966c000000b0031bf85a4124so19921651ooi.0 for ; Mon, 28 Feb 2022 11:09:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=PaQ21wLnBLiJODP+CyvOliuTsXfUJD7dOXJ56ZguLwo=; b=RMmd0Mnxatrn+g4xyREf+wbgHdP01alNYFtcs49HwpLeo5CeT6ZpRm9S6XFrynGdCD eASOhMO3BNL66wdLuPwiW7KDxmXY/17Su1SmbEiKzrWZgmr2s2Ke1N7wU9i/uWn6pHER PA5GNccX2CbgwsnpVe+IMq4/613b6bEWCvz18= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=PaQ21wLnBLiJODP+CyvOliuTsXfUJD7dOXJ56ZguLwo=; b=a86erhbgncpUW2wUubpRwI4NOn+r6JGc3J/OZYfmrV0n4fCNFpQBk9TdOSLpF7Cwg6 38jJFoFbZCEHF5XnKyx34oGqW2gqIZZF5Be7jNdjPpYjvbvFCf43cJKiPpjy4hc3dQOE ACMlNjrQv634KXsWFy2heDXfo6S/DPUPSZkMI+JcOalN1dL3vlud0nYLHPlpunv2zLvN 1gZppcnd+eyde+NqjjqNtSOKqXv1L9S/9rkf+u4eNduBjBRkMvBZqgDDRE+vK6kIbOFM uFWZ7lQBzL8rOH+DRhp6ckkkYNp2lPfLu/Mz6Vj6sFRbj6GeX+RwFQB62TQz0SPa+Tcg EoOw== X-Gm-Message-State: AOAM531E5+d3sHyxS2JstT2D6G/ECYxnSpztB8yRIizv1lbIBjLCKoPt dxGeHbVvKejREN+4OAVIbX+/nPhBm2O2ig== X-Google-Smtp-Source: ABdhPJxxe3W+XxABsNaAglNLneOnfzGZ8QV5dTl906o59T4o95Zh/HvTDwhtnY70+gvdBrUI7YVCxg== X-Received: by 2002:a05:6870:390a:b0:d7:47a1:90c1 with SMTP id b10-20020a056870390a00b000d747a190c1mr1372074oap.162.1646075346063; Mon, 28 Feb 2022 11:09:06 -0800 (PST) Received: from kiwi.bld.corp.google.com (c-67-190-101-114.hsd1.co.comcast.net. [67.190.101.114]) by smtp.gmail.com with ESMTPSA id f188-20020a4a58c5000000b0031ccb8272f1sm5290577oob.33.2022.02.28.11.09.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Feb 2022 11:09:05 -0800 (PST) From: Simon Glass To: U-Boot Mailing List Cc: Tom Rini , Simon Glass Subject: [PATCH 05/18] abuf: Correct a corner case with abuf_realloc() Date: Mon, 28 Feb 2022 12:08:22 -0700 Message-Id: <20220228190835.1480772-6-sjg@chromium.org> X-Mailer: git-send-email 2.35.1.574.g5d30c73bfb-goog In-Reply-To: <20220228190835.1480772-1-sjg@chromium.org> References: <20220228190835.1480772-1-sjg@chromium.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean If the buffer is empty and not allocated, then abuf_realloc() tries to copy invalid data. This happens because an incorrect change to use memdup() was added after the original code was written. Signed-off-by: Simon Glass --- lib/abuf.c | 4 +++- test/lib/abuf.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/lib/abuf.c b/lib/abuf.c index 4b17e0b8c0..1635d58682 100644 --- a/lib/abuf.c +++ b/lib/abuf.c @@ -51,9 +51,11 @@ bool abuf_realloc(struct abuf *abuf, size_t new_size) /* not currently allocated and new size is larger. Alloc and * copy in data. The new space is not inited. */ - ptr = memdup(abuf->data, new_size); + ptr = malloc(new_size); if (!ptr) return false; + if (abuf->size) + memcpy(ptr, abuf->data, abuf->size); abuf->data = ptr; abuf->size = new_size; abuf->alloced = true; diff --git a/test/lib/abuf.c b/test/lib/abuf.c index 086c9b2282..42ee4c1755 100644 --- a/test/lib/abuf.c +++ b/test/lib/abuf.c @@ -126,6 +126,35 @@ static int lib_test_abuf_realloc(struct unit_test_state *uts) } LIB_TEST(lib_test_abuf_realloc, 0); +/* Test abuf_realloc() on an non-allocated buffer of zero size */ +static int lib_test_abuf_realloc_size(struct unit_test_state *uts) +{ + struct abuf buf; + ulong start; + + start = ut_check_free(); + + abuf_init(&buf); + + /* Allocate some space */ + ut_asserteq(true, abuf_realloc(&buf, TEST_DATA_LEN)); + ut_assertnonnull(buf.data); + ut_asserteq(TEST_DATA_LEN, buf.size); + ut_asserteq(true, buf.alloced); + + /* Free it */ + ut_asserteq(true, abuf_realloc(&buf, 0)); + ut_assertnull(buf.data); + ut_asserteq(0, buf.size); + ut_asserteq(false, buf.alloced); + + /* Check for memory leaks */ + ut_assertok(ut_check_delta(start)); + + return 0; +} +LIB_TEST(lib_test_abuf_realloc_size, 0); + /* Test handling of buffers that are too large */ static int lib_test_abuf_large(struct unit_test_state *uts) {