mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails
@ 2021-09-22  7:14 Ahmad Fatoum
  2021-09-22  7:14 ` [PATCH master 2/2] common: menutree: prevent read of uninitialized memory in error path Ahmad Fatoum
  2021-10-01 13:29 ` [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Sascha Hauer
  0 siblings, 2 replies; 3+ messages in thread
From: Ahmad Fatoum @ 2021-09-22  7:14 UTC (permalink / raw)
  To: barebox; +Cc: Ahmad Fatoum

globfree() is a no-op if glob_t::gl_pathv is NULL. A failed glob may not
always initialize this member however, leading to potential memory
corruption.

Fix this by only freeing the glob_t if glob() had succeeded.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/startup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/common/startup.c b/common/startup.c
index d170cb8a7c5a..871696968a14 100644
--- a/common/startup.c
+++ b/common/startup.c
@@ -345,9 +345,9 @@ static int run_init(void)
 			run_command(scr);
 			free(scr);
 		}
-	}
 
-	globfree(&g);
+		globfree(&g);
+	}
 
 	/* source matching script in /env/bmode/ */
 	bmode = reboot_mode_get();
-- 
2.30.2


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PATCH master 2/2] common: menutree: prevent read of uninitialized memory in error path
  2021-09-22  7:14 [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Ahmad Fatoum
@ 2021-09-22  7:14 ` Ahmad Fatoum
  2021-10-01 13:29 ` [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Sascha Hauer
  1 sibling, 0 replies; 3+ messages in thread
From: Ahmad Fatoum @ 2021-09-22  7:14 UTC (permalink / raw)
  To: barebox; +Cc: Ahmad Fatoum

globfree() is a no-op if glob_t::gl_pathv is NULL. A failed glob may not
always initialize this member however, leading to potential memory
corruption.

Fix this by initializing glob_t.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/menutree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/menutree.c b/common/menutree.c
index c28284b47a0c..9a14005ea209 100644
--- a/common/menutree.c
+++ b/common/menutree.c
@@ -84,7 +84,7 @@ int menutree(const char *path, int toplevel)
 	struct stat s;
 	char *box;
 	struct menutree *mt;
-	glob_t g;
+	glob_t g = {};
 	int i;
 	char *globpath, *display;
 	size_t size;
-- 
2.30.2


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails
  2021-09-22  7:14 [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Ahmad Fatoum
  2021-09-22  7:14 ` [PATCH master 2/2] common: menutree: prevent read of uninitialized memory in error path Ahmad Fatoum
@ 2021-10-01 13:29 ` Sascha Hauer
  1 sibling, 0 replies; 3+ messages in thread
From: Sascha Hauer @ 2021-10-01 13:29 UTC (permalink / raw)
  To: Ahmad Fatoum; +Cc: barebox

On Wed, Sep 22, 2021 at 09:14:39AM +0200, Ahmad Fatoum wrote:
> globfree() is a no-op if glob_t::gl_pathv is NULL. A failed glob may not
> always initialize this member however, leading to potential memory
> corruption.
> 
> Fix this by only freeing the glob_t if glob() had succeeded.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  common/startup.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Applied, thanks

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-10-01 13:30 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-22  7:14 [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Ahmad Fatoum
2021-09-22  7:14 ` [PATCH master 2/2] common: menutree: prevent read of uninitialized memory in error path Ahmad Fatoum
2021-10-01 13:29 ` [PATCH master 1/2] startup: don't read glob_t if glob("/env/init/*") fails Sascha Hauer

mail archive of the barebox mailing list

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://lore.barebox.org/barebox/0 barebox/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 barebox barebox/ https://lore.barebox.org/barebox \
		barebox@lists.infradead.org
	public-inbox-index barebox

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git