cros_read_bootflow() stores priv in bflow->bootmeth_priv and then
calls cros_read_info(). If that fails, priv is freed but
bflow->bootmeth_priv keeps pointing at the freed memory.
With 'bootflow scan -a', failed bootflows are stored in the bootstd
list, so the stale pointer is kept and bootflow_free() later frees it
a second time, corrupting the heap. This is the same problem recently
fixed in the RAUC bootmeth.
Clear bflow->bootmeth_priv after freeing, as bootmeth_android already
does.
Fixes: 71f634b822ae ("bootstd: cros: Allow detection of any kernel partition")
Signed-off-by: Aristo Chen <[email protected]>
---
boot/bootmeth_cros.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/boot/bootmeth_cros.c b/boot/bootmeth_cros.c
index c7b862e512a..f894ed78e3a 100644
--- a/boot/bootmeth_cros.c
+++ b/boot/bootmeth_cros.c
@@ -405,6 +405,7 @@ static int cros_read_bootflow(struct udevice *dev, struct
bootflow *bflow)
if (ret) {
free(priv->info_buf);
free(priv);
+ bflow->bootmeth_priv = NULL;
return log_msg_ret("inf", ret);
}
bflow->size = priv->body_size;
--
2.43.0
