domenico/openwrt-R7800-nss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mtd: check the return value of malloc and pread

Browse Source 
Check the return value of malloc and pread in case they fail.

Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
(cherry picked from commit 3f014543cd4bd099dc089cbb9b9b2d7b0db8a021)
Signed-off-by: Rafal Boni <rafal.boni@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17889
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Qiyuan Zhang
2024-08-05 06:47:21 -04:00
committed by Robert Marko
parent 45ce95a9b3
commit 082608fd2b
1 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
package/system/mtd/src/linksys_bootcount.c
View File

@@ -108,15 +108,29 @@ int mtd_resetbc(const char *mtd)
num_bc = mtd_info.size / bc_offset_increment;
curr = malloc(bc_offset_increment);
if(curr == NULL) {
DLOG_ERR("Failed to allocate %u bytes from memory.", bc_offset_increment);
retval = -6;
goto out;
}
for (i = 0; i < num_bc; i++) {
pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
ret = pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
if(ret != sizeof(struct bootcounter)) {
DLOG_ERR("Failed to read boot-count log at offset 0x%08x.", i * bc_offset_increment);
retval = -5;
goto out;
}
/* Existing code assumes erase is to 0xff; left as-is (2019) */
if (curr->magic == 0xffffffff)
break;
if (curr->magic != BOOTCOUNT_MAGIC || curr->checksum != curr->magic + curr->count) {
DLOG_ERR("Unexpected boot-count log at offset %08x: magic %08x boot count %08x checksum %08x; aborting.",
DLOG_ERR("Unexpected boot-count log at offset 0x%08x: magic 0x%08x boot count 0x%08x checksum 0x%08x; aborting.",
i * bc_offset_increment, curr->magic, curr->count, curr->checksum);
retval = -2;
@@ -179,7 +193,9 @@ int mtd_resetbc(const char *mtd)
}
out:
if (curr != NULL) free(curr);
if (curr != NULL)
free(curr);
close(fd);
return retval;
}