diff options
| author | Ahmad Fatoum <ahmad@a3f.at> | 2021-09-13 10:29:57 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2021-10-04 12:46:31 +0200 |
| commit | ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85 (patch) | |
| tree | 97aa709cd3e6bd8da319ad3aca63a53dcead6ceb /common/firmware.c | |
| parent | 90583805dcd7745d2d3fbac5a95e70a3b11aaff2 (diff) | |
| download | barebox-ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85.tar.gz | |
blspec: fix use-after-free of firmware search path
firmware_set_searchpath() is used to temporarily extend firmware search
path when parsing boot spec files. It does so by first freeing the
original firmware pointer and then storing a pointer to a copy of the
new search path.
firmware_get_searchpath() returns this pointer without copying meaning
that following sequence causes a use-after-free:
old_fws = firmware_get_searchpath();
firmware_set_searchpath(fws); /* calls free(old_fws) */
firmware_set_searchpath(old_fws);
Fix this by keeping around a copy of the search path.
Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath")
Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Link: https://lore.barebox.org/20210913082957.364440-1-ahmad@a3f.at
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'common/firmware.c')
| -rw-r--r-- | common/firmware.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/common/firmware.c b/common/firmware.c index b33acff77f..b87d7da38f 100644 --- a/common/firmware.c +++ b/common/firmware.c @@ -224,9 +224,9 @@ out: static char *firmware_path; -const char *firmware_get_searchpath(void) +char *firmware_get_searchpath(void) { - return firmware_path; + return strdup(firmware_path); } void firmware_set_searchpath(const char *path) |