diff options
| author | Kory Maincent <[email protected]> | 2026-04-07 14:34:35 +0200 |
|---|---|---|
| committer | Ilias Apalodimas <[email protected]> | 2026-05-12 09:31:51 +0300 |
| commit | d5ea30b233e8162898d44da2c20dfc88e27d23db (patch) | |
| tree | 8aff082d5560be42b128242b0fb4d057cfa31ab3 | |
| parent | 5732bd0f457b4c671e46574d64d4acb099c0f0a5 (diff) | |
tools: fwumdata: Fix use-after-free in parse_config()
In parse_config(), devname is dynamically allocated by sscanf().
When sscanf() fails to fill enough fields (rc < 3), devname is freed and
the loop continues to the next line. However, if the next call to sscanf()
fails to match (rc == 0), devname is not written and still holds the stale
freed pointer. The subsequent free(devname) then operates on
already-freed memory.
Fix this by resetting devname to NULL before each sscanf() call, so
that a non-matching call leaves a NULL pointer and the subsequent
free() becomes a harmless no-op.
Reported-by: Coverity Scan
Link: https://lists.denx.de/pipermail/u-boot/2026-April/614161.html
Signed-off-by: Kory Maincent <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
| -rw-r--r-- | tools/fwumdata_src/fwumdata.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/tools/fwumdata_src/fwumdata.c b/tools/fwumdata_src/fwumdata.c index c5b0f56842d..44195ce2bf2 100644 --- a/tools/fwumdata_src/fwumdata.c +++ b/tools/fwumdata_src/fwumdata.c @@ -84,6 +84,7 @@ static int parse_config(const char *fname) if (line[0] == '#' || line[0] == '\n') continue; + devname = NULL; rc = sscanf(line, "%ms %lli %lx %lx", &devname, &devices[i].devoff, |