Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

boot: pxe_utils: Fix memory allocation issues in overlay_dir handling

Browse Source 
Fix two memory allocation bugs in label_boot_extension():

1. When label->fdtdir is not set, overlay_dir was used without any
   memory allocation.

2. When label->fdtdir is set, the allocation size was incorrect,
   using 'len' (just the fdtdir length) instead of 'dir_len' (which
   includes the trailing slash and null terminator).

Resolve both issues by moving the memory allocation and string
formatting outside the conditional block, resulting in clearer code
flow and correct sizing in all cases.

Closes: https://lists.denx.de/pipermail/u-boot/2025-November/602892.html
Addresses-Coverity-ID: 638558 Memory - illegal accesses (UNINIT)
Fixes: 935109cd9e ("boot: pxe_utils: Add extension board devicetree overlay support")
Signed-off-by: Kory Maincent (TI.com) <kory.maincent@bootlin.com>
Tested-by: Surkov Kirill <fanra3.tk@gmail.com>
This commit is contained in:
Kory Maincent (TI.com)
2025-11-17 16:23:07 +01:00
committed by Tom Rini
parent 8385ecc8ef
commit 2d7eee5a55
1 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
boot/pxe_utils.c
View File

@@ -444,7 +444,7 @@ static void label_boot_extension(struct pxe_context *ctx,
const struct extension *extension;
struct fdt_header *working_fdt;
struct alist *extension_list;
int ret, dir_len, len;
int ret, dir_len, len = 0;
char *overlay_dir;
const char *slash;
ulong fdt_addr;
@@ -472,18 +472,16 @@ static void label_boot_extension(struct pxe_context *ctx,
slash = "/";
else
slash = "";
dir_len = strlen(label->fdtdir) + strlen(slash) + 1;
overlay_dir = calloc(1, len);
if (!overlay_dir)
return;
snprintf(overlay_dir, dir_len, "%s%s", label->fdtdir,
slash);
} else {
dir_len = 2;
snprintf(overlay_dir, dir_len, "/");
slash = "/";
}
dir_len = len + strlen(slash) + 1;
overlay_dir = calloc(1, dir_len);
if (!overlay_dir)
return;
snprintf(overlay_dir, dir_len, "%s%s", label->fdtdir ?: "", slash);
alist_for_each(extension, extension_list) {
char *overlay_file;