Skip to content

Commit

Permalink
Fix a NULL pointer access when boot components are uncompressed
Browse files Browse the repository at this point in the history
When boot components are not compressed, their names do not have any
file extension. When checking whether a component is a GZIP file, code
in payload.c calls function isgzip(s) with `s' being a component name.
The name is passed to ext() which returns NULL if no extension is
present. The result is directly passed by isgzip() to str_cmp() and
would cause a NULL pointer access in the latter function.

Fix this by updating function isgzip() to check a result from the ext()
call. For consistency, update similarly function basename() in the same
file.
  • Loading branch information
petrpavlu committed May 26, 2020
1 parent 145a13b commit df7dc9e
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions boot/generic/src/payload.c
Original file line number Diff line number Diff line change
Expand Up @@ -60,13 +60,14 @@ static const char *ext(const char *s)
static void basename(char *s)
{
char *e = (char *) ext(s);
if (str_cmp(e, ".gz") == 0)
if (e != NULL && str_cmp(e, ".gz") == 0)
*e = '\0';
}

static bool isgzip(const char *s)
{
return str_cmp(ext(s), ".gz") == 0;
const char *e = ext(s);
return e != NULL && str_cmp(e, ".gz") == 0;
}

static bool overlaps(uint8_t *start1, uint8_t *end1,
Expand Down

0 comments on commit df7dc9e

Please sign in to comment.