From 8910efa71b8bab88b0ca81b681b5842fd25b1000 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Fri, 5 Dec 2025 17:28:36 +0000 Subject: [PATCH 1/2] net: lwip: tftp: Fix filename handling The code to choose the filename to use does not cope with no name set at all. Firstly the test for a name in net_boot_file_name tests the pointer rather than the string it points to. Secondly the cleanup on exit in this case attempts to free a global variable. Fix both issues. Signed-off-by: Andrew Goodbody Reviewed-by: Jerome Forissier --- net/lwip/tftp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/lwip/tftp.c b/net/lwip/tftp.c index 94bacf63075..6c7ffba661e 100644 --- a/net/lwip/tftp.c +++ b/net/lwip/tftp.c @@ -279,7 +279,7 @@ int do_tftpb(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) if (!arg) arg = net_boot_file_name; - if (arg) { + if (*arg) { /* Parse [ip:[port:]]fname */ i = 0; while ((*(words + i) = strsep(&arg, ":"))) @@ -342,6 +342,7 @@ int do_tftpb(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) if (tftp_loop(eth_get_dev(), laddr, fname, srvip, port) < 0) ret = CMD_RET_FAILURE; out: - free(arg); + if (arg != net_boot_file_name) + free(arg); return ret; } From a8a81af848b88d7ecee64d98a08f6415630305b3 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Mon, 1 Dec 2025 16:17:24 +0100 Subject: [PATCH 2/2] cmd: lwip/wget: avoid NULL dereference in _set_cacert() Running `wget cacert builtin` leads to a crash in _set_cacert(): Unhandled exception: Load access fault Function _set_cacert() dereferences variable wget_info. We must initialize it before executing the cacert sub-command. Fixes: d3761a31ef09 ("lwip: split net/lwip/wget.c") Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier Reviewed-by: Ilias Apalodimas --- cmd/lwip/wget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cmd/lwip/wget.c b/cmd/lwip/wget.c index fc9bc11cd83..4883ad61bce 100644 --- a/cmd/lwip/wget.c +++ b/cmd/lwip/wget.c @@ -180,6 +180,8 @@ int do_wget(struct cmd_tbl *cmdtp, int flag, int argc, char * const argv[]) ulong dst_addr; char nurl[1024]; + wget_info = &default_wget_info; + #if CONFIG_IS_ENABLED(WGET_CACERT) if (argc == 4 && !strncmp(argv[1], "cacert", strlen("cacert"))) return set_cacert(argv[2], argv[3]); @@ -214,7 +216,6 @@ int do_wget(struct cmd_tbl *cmdtp, int flag, int argc, char * const argv[]) if (parse_legacy_arg(url, nurl, sizeof(nurl))) return CMD_RET_FAILURE; - wget_info = &default_wget_info; if (wget_do_request(dst_addr, nurl)) return CMD_RET_FAILURE;