V3s_Allwinner
/
uboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

hush: fix segfault on syntax error 

Hush segfaults if it sees a syntax error while attempting to parse a
command:

 $ ./u-boot -c "'"
 ...
 syntax error
 Segmentation fault (core dumped)

This is due to a NULL pointer dereference of in_str->p in static_peek().
The problem is that the exit condition for the loop in
parse_stream_outer() checks for rcode not being -1, but rcode is only
ever 0 or 1.

Signed-off-by: Rabin Vincent <rabin@rab.in>
Acked-by: Simon Glass <sjg@chromium.org)
Tested-by: Simon Glass <sjg@chromium.org)
This commit is contained in:
Rabin Vincent 2014-10-29 23:21:40 +01:00 committed by Tom Rini
parent 484408fb51
commit 128059b926
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/cli_hush.c
View File

@ -3217,7 +3217,7 @@ static int parse_stream_outer(struct in_str *inp, int flag)
} }
b_free(&temp); b_free(&temp);
/* loop on syntax errors, return on EOF */ /* loop on syntax errors, return on EOF */
} while (rcode != -1 && !(flag & FLAG_EXIT_FROM_LOOP) && } while (rcode != 1 && !(flag & FLAG_EXIT_FROM_LOOP) &&
(inp->peek != static_peek || b_peek(inp))); (inp->peek != static_peek || b_peek(inp)));
#ifndef __U_BOOT__ #ifndef __U_BOOT__
return 0; return 0;