distro_rauc_read_bootflow() duplicates the default boot order and the
partition list with strdup(), then parses both with strsep(), which
advances the pointers until they are NULL. The error path then calls
free() on the advanced pointers, which is a no-op, and the success
path does not free them at all. The two buffers leak on every RAUC
read_bootflow() call.
This also removes a landmine: if the two lists ever had different
lengths, the leftover pointer would point into the middle of its
buffer and free() would be called on an interior pointer, corrupting
the heap.
Parse via separate cursor variables and free the original pointers on
both paths.
Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc")
Signed-off-by: Aristo Chen <[email protected]>
---
boot/bootmeth_rauc.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c
index 12ab9fc5bbd..2df141f7424 100644
--- a/boot/bootmeth_rauc.c
+++ b/boot/bootmeth_rauc.c
@@ -147,10 +147,12 @@ static int distro_rauc_read_bootflow(struct udevice *dev,
struct bootflow *bflow
char *slot;
int i;
char *partitions = NULL;
+ char *partitions_cursor;
char *boot_order = NULL;
const char *default_boot_order;
const char **default_boot_order_list;
char *boot_order_copy;
+ char *boot_order_cursor;
char boot_left[BOOT_LEFT_LEN];
char *parts;
@@ -198,9 +200,11 @@ static int distro_rauc_read_bootflow(struct udevice *dev,
struct bootflow *bflow
goto rauc_read_bootflow_err;
}
+ partitions_cursor = partitions;
+ boot_order_cursor = boot_order_copy;
for (i = 1;
- (parts = strsep(&partitions, " ")) &&
- (slot = strsep(&boot_order_copy, " "));
+ (parts = strsep(&partitions_cursor, " ")) &&
+ (slot = strsep(&boot_order_cursor, " "));
i++) {
struct distro_rauc_slot *s;
struct distro_rauc_slot **new_slots;
@@ -239,6 +243,9 @@ static int distro_rauc_read_bootflow(struct udevice *dev,
struct bootflow *bflow
bflow->state = BOOTFLOWST_READY;
+ free(boot_order_copy);
+ free(partitions);
+
return 0;
rauc_read_bootflow_err:
--
2.43.0
