summaryrefslogtreecommitdiff
path: root/cmd/mtdparts.c
diff options
context:
space:
mode:
authorLadislav Michl <ladis@linux-mips.org>2016-07-12 20:28:23 +0200
committerTom Rini <trini@konsulko.com>2016-07-22 14:46:13 -0400
commit06a040a31bcfc2673ab0670ee95fb9b078c4fdda (patch)
tree7de16f1bbfc6b506446c3f5014cabfabb3950918 /cmd/mtdparts.c
parentc0ac3339475d3b6afc0cd901f20dd21d5fade17d (diff)
downloadu-boot-imx-06a040a31bcfc2673ab0670ee95fb9b078c4fdda.zip
u-boot-imx-06a040a31bcfc2673ab0670ee95fb9b078c4fdda.tar.gz
u-boot-imx-06a040a31bcfc2673ab0670ee95fb9b078c4fdda.tar.bz2
cmd: mtdparts: fix null pointer dereference in parse_mtdparts
In case there is no mtdparts variable in relocated environment, NULL is assigned to p, which is later fed to strncpy. Also function parameter mtdparts is completely ignored, so use it in case mtdparts variable is not found in environment. This parameter is checked not to be NULL in caller. Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Diffstat (limited to 'cmd/mtdparts.c')
-rw-r--r--cmd/mtdparts.c23
1 files changed, 13 insertions, 10 deletions
diff --git a/cmd/mtdparts.c b/cmd/mtdparts.c
index 3a88a10..995cb87 100644
--- a/cmd/mtdparts.c
+++ b/cmd/mtdparts.c
@@ -1524,7 +1524,7 @@ static int spread_partitions(void)
*/
static int parse_mtdparts(const char *const mtdparts)
{
- const char *p = mtdparts;
+ const char *p;
struct mtd_device *dev;
int err = 1;
char tmp_parts[MTDPARTS_MAXLEN];
@@ -1538,20 +1538,25 @@ static int parse_mtdparts(const char *const mtdparts)
}
/* re-read 'mtdparts' variable, mtd_devices_init may be updating env */
- if (gd->flags & GD_FLG_ENV_READY) {
+ if (gd->flags & GD_FLG_ENV_READY)
p = getenv("mtdparts");
- } else {
- p = tmp_parts;
- getenv_f("mtdparts", tmp_parts, MTDPARTS_MAXLEN);
+ else {
+ if (getenv_f("mtdparts", tmp_parts, MTDPARTS_MAXLEN) != -1)
+ p = tmp_parts;
+ else
+ p = NULL;
}
+ if (!p)
+ p = mtdparts;
+
if (strncmp(p, "mtdparts=", 9) != 0) {
printf("mtdparts variable doesn't start with 'mtdparts='\n");
return err;
}
p += 9;
- while (p && (*p != '\0')) {
+ while (*p != '\0') {
err = 1;
if ((device_parse(p, &p, &dev) != 0) || (!dev))
break;
@@ -1569,12 +1574,10 @@ static int parse_mtdparts(const char *const mtdparts)
list_add_tail(&dev->link, &devices);
err = 0;
}
- if (err == 1) {
+ if (err == 1)
device_delall(&devices);
- return 1;
- }
- return 0;
+ return err;
}
/**