[PATCH 3/4] commands: boot: fix use-after-free of overrides taken from globalvars

[Sascha Hauer <s.hauer@pengutronix.de>]

When boot -o is given a variable without a value, e.g.
"boot -o bootm.image", boot_add_override() stores the pointer returned
by globalvar_get(). That string belongs to the globalvar. When the boot
entry then sets the globalvar, which is what boot scripts usually do
with global.bootm.image, the string is freed and the override points to
freed memory. In practice the override silently turns into the value
the script set, as the new value tends to land at the same address.

Store a copy of the override values and free them when do_boot()
returns. While at it, route the remaining early returns through the
cleanup path, which also fixes leaking the boot entries when the menu
default entry is invalid.

Fixes: a5e4c4340ef6 ("commands: boot: add support for overriding boot artifacts")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 commands/boot.c | 38 ++++++++++++++++++++++++++++++--------
 1 file changed, 30 insertions(+), 8 deletions(-)

diff --git a/commands/boot.c b/commands/boot.c
index cc7a64bcca..b436afa91d 100644
--- a/commands/boot.c
+++ b/commands/boot.c
@@ -25,6 +25,23 @@ static char *next_word(void *context)
 	return strsep(context, " ");
 }
 
+static void boot_set_override(const char **override, const char *val)
+{
+	free_const(*override);
+	/*
+	 * Copy the value: if it was taken from a globalvar, the boot entry
+	 * may change that globalvar, freeing the original string.
+	 */
+	*override = val ? xstrdup(val) : NULL;
+}
+
+static void boot_free_overrides(struct bootm_overrides *overrides)
+{
+	free_const(overrides->os_file);
+	free_const(overrides->oftree_file);
+	free_const(overrides->initrd_file);
+}
+
 static int boot_add_override(struct bootm_overrides *overrides, char *var)
 {
 	const char *val;
@@ -44,11 +61,11 @@ static int boot_add_override(struct bootm_overrides *overrides, char *var)
 	if (!strcmp(var, "bootm.image")) {
 		if (isempty(val))
 			return -EINVAL;
-		overrides->os_file = val;
+		boot_set_override(&overrides->os_file, val);
 	} else if (!strcmp(var, "bootm.oftree")) {
-		overrides->oftree_file = val;
+		boot_set_override(&overrides->oftree_file, val);
 	} else if (!strcmp(var, "bootm.initrd")) {
-		overrides->initrd_file = val;
+		boot_set_override(&overrides->initrd_file, val);
 	} else {
 		return -EINVAL;
 	}
@@ -124,10 +141,11 @@ static int do_boot(int argc, char *argv[])
 		case 'o':
 			ret = boot_add_override(&overrides, optarg);
 			if (ret)
-				return ret;
+				goto out_overrides;
 			break;
 		default:
-			return COMMAND_ERROR_USAGE;
+			ret = COMMAND_ERROR_USAGE;
+			goto out_overrides;
 		}
 	}
 
@@ -139,7 +157,7 @@ static int do_boot(int argc, char *argv[])
 
 		def = getenv("global.boot.default");
 		if (!def)
-			return 0;
+			goto out_overrides;
 
 		handle = freep = xstrdup(def);
 		next = next_word;
@@ -181,8 +199,10 @@ static int do_boot(int argc, char *argv[])
 		int idx;
 
 		idx = bootentries_get_default_menu_entry(entries, default_menu_entry);
-		if (idx < 0)
-			return idx;
+		if (idx < 0) {
+			ret = idx;
+			goto out;
+		}
 
 		bootsources_menu(entries, idx, timeout);
 	}
@@ -191,6 +211,8 @@ static int do_boot(int argc, char *argv[])
 out:
 	bootentries_free(entries);
 	free(freep);
+out_overrides:
+	boot_free_overrides(&overrides);
 
 	return ret;
 }

-- 
2.47.3