Commit b237d358b "moveconfig: expand simple expressions" added support
for expanding expressions in configs, but used the unsafe python
built-in "eval". This patch fixes this by replacing eval with the
asteval module.
Signed-off-by: Markus Klotzbuecher <m...@mkio.de>
Cc: Heinrich Schuchardt <xypron.g...@gmx.de>
Cc: Heiko Schocher <h...@denx.de>
Cc: Tom Rini <tr...@konsulko.com>
Cc: Simon Glass <s...@chromium.org>
Cc: Joe Hershberger <joe.hershber...@ni.com>
Cc: Masahiro Yamada <yamada.masah...@socionext.com>
---
tools/moveconfig.py | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/moveconfig.py b/tools/moveconfig.py
index 36160a3977..df20ec66af 100755
--- a/tools/moveconfig.py
+++ b/tools/moveconfig.py
@@ -295,6 +295,7 @@ To see the complete list of supported options, run
"""
+import asteval
import collections
import copy
import difflib
@@ -808,10 +809,11 @@ def try_expand(line):
return line
try:
+ aeval = asteval.Interpreter( usersyms=SIZES, minimal=True )
cfg, val = re.split("=", line)
val= val.strip('\"')
if re.search("[*+-/]|<<|SZ_+|\(([^\)]+)\)", val):
- newval = hex(eval(val, SIZES))
+ newval = hex(aeval(val))
print("\tExpanded expression %s to %s" % (val, newval))
return cfg+'='+newval
except:
--
2.25.0
