Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

efi_loader: correctly check if the HTTP protocol is found

Browse Source 
In function efi_http_service_binding_destroy_child() phandler is created as
as a local variable. If efi_search_protocol() fails, phandler will hold a
random value from the stack. Even it is not zero, we must not use it.

If efi_search_protocol() succeeds, the pointer has already be dereferenced,
so checking against NULL makes not sense here.

If ChildHandle is not a valid UEFI handle, we must return
EFI_INVALID_PARAMETER.

Use a single location for EFI_EXIT().

Addresses-Coverity-ID: CID 531974 (Unchecked return value)
Fixes: 5753dc3f65 ("efi_loader: Prevent dereference of uninitialised variable")
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
This commit is contained in:
Heinrich Schuchardt
2025-10-06 15:39:03 +02:00
parent 11a64138f5
commit 163f9d04fb
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/efi_loader/efi_http.c
View File

@@ -460,14 +460,16 @@ static efi_status_t EFIAPI efi_http_service_binding_destroy_child(
if (!child_handle)
return EFI_EXIT(EFI_INVALID_PARAMETER);
efi_search_protocol(child_handle, &efi_http_guid, &phandler);
if (!phandler)
return EFI_EXIT(EFI_UNSUPPORTED);
ret = efi_search_protocol(child_handle, &efi_http_guid, &phandler);
if (ret != EFI_SUCCESS) {
if (ret != EFI_INVALID_PARAMETER)
ret = EFI_UNSUPPORTED;
goto out;
}
ret = efi_delete_handle(child_handle);
if (ret != EFI_SUCCESS)
return EFI_EXIT(ret);
goto out;
http_instance = phandler->protocol_interface;
efi_free_pool(http_instance->http_load_addr);
@@ -476,8 +478,8 @@ static efi_status_t EFIAPI efi_http_service_binding_destroy_child(
free(phandler->protocol_interface);
num_instances--;
return EFI_EXIT(EFI_SUCCESS);
out:
return EFI_EXIT(ret);
}
/**