cmd: ini: avoid NULL deref when loadaddr/filesize env vars are unset

When the user runs "ini <section>" without explicit address or size
arguments, do_ini() falls back to env_get("loadaddr") and
env_get("filesize") and passes the results straight to hextoul().
env_get() returns NULL for an undefined variable and hextoul() does
not tolerate a NULL pointer, so on a board without these variables
set the command dereferences NULL.

Fetch the strings into locals first, reject the NULL case with
CMD_RET_USAGE, and only then convert to numeric values.

Fixes: c167cc02033 ("Add a new "ini" command")
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>

1 files changed, 11 insertions, 4 deletions

diff --git a/cmd/ini.c b/cmd/ini.c
index 96399017691..3fe86209c32 100644
--- a/cmd/ini.c
+++ b/cmd/ini.c
@@ -229,6 +229,7 @@ static int ini_handler(void *user, char *section, char *name, char *value)
 static int do_ini(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
 {
 	const char *section;
+	const char *addr_str, *size_str;
 	char *file_address;
 	size_t file_size;
 
@@ -236,10 +237,16 @@ static int do_ini(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
 		return CMD_RET_USAGE;
 
 	section = argv[1];
-	file_address = (char *)hextoul(argc < 3 ? env_get("loadaddr") : argv[2],
-					NULL);
-	file_size = (size_t)hextoul(argc < 4 ? env_get("filesize") : argv[3],
-				     NULL);
+	addr_str = argc < 3 ? env_get("loadaddr") : argv[2];
+	size_str = argc < 4 ? env_get("filesize") : argv[3];
+
+	if (!addr_str || !size_str) {
+		printf("ini: loadaddr/filesize not set\n");
+		return CMD_RET_USAGE;
+	}
+
+	file_address = (char *)hextoul(addr_str, NULL);
+	file_size = (size_t)hextoul(size_str, NULL);
 
 	return ini_parse(file_address, file_size, ini_handler, (void *)section);
 }