leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cmd: fastboot: Validate user input

Browse Source 
In case when user provides '-' as USB controller index, like this:

    => fastboot -

data abort occurs in strcmp() function in do_fastboot(), here:

    if (!strcmp(argv[1], "udp"))

(tested on BeagleBone Black).

That's because argv[1] is NULL when user types in the '-', and null
pointer dereference occurs in strcmp() (which is ok according to C
standard specification). So we must validate user input to prevent such
behavior.

While at it, check also the result of strtoul() function and handle
error cases properly.

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Lukasz Majewski <lukma@denx.de>
This commit is contained in:
Sam Protsenko 2018-06-29 21:59:40 +03:00 committed by Marek Vasut
parent 9f8cf76be2
commit aa51579f9a
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/fastboot.c
View File

@ -38,13 +38,18 @@ static int do_fastboot_usb(int argc, char *const argv[],
#if CONFIG_IS_ENABLED(USB_FUNCTION_FASTBOOT)
int controller_index;
char *usb_controller;
char *endp;
int ret;
if (argc < 2)
return CMD_RET_USAGE;
usb_controller = argv[1];
controller_index = simple_strtoul(usb_controller, NULL, 0);
controller_index = simple_strtoul(usb_controller, &endp, 0);
if (*endp != '\0') {
pr_err("Error: Wrong USB controller index format\n");
return CMD_RET_FAILURE;
}
ret = board_usb_init(controller_index, USB_INIT_DEVICE);
if (ret) {
@ -120,6 +125,12 @@ NXTARG:
;
}
/* Handle case when USB controller param is just '-' */
if (argc == 1) {
pr_err("Error: Incorrect USB controller index\n");
return CMD_RET_USAGE;
}
fastboot_init((void *)buf_addr, buf_size);
if (!strcmp(argv[1], "udp"))