From ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85 Mon Sep 17 00:00:00 2001 From: Ahmad Fatoum Date: Mon, 13 Sep 2021 10:29:57 +0200 Subject: blspec: fix use-after-free of firmware search path firmware_set_searchpath() is used to temporarily extend firmware search path when parsing boot spec files. It does so by first freeing the original firmware pointer and then storing a pointer to a copy of the new search path. firmware_get_searchpath() returns this pointer without copying meaning that following sequence causes a use-after-free: old_fws = firmware_get_searchpath(); firmware_set_searchpath(fws); /* calls free(old_fws) */ firmware_set_searchpath(old_fws); Fix this by keeping around a copy of the search path. Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath") Signed-off-by: Ahmad Fatoum Link: https://lore.barebox.org/20210913082957.364440-1-ahmad@a3f.at Signed-off-by: Sascha Hauer --- common/firmware.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'common/firmware.c') diff --git a/common/firmware.c b/common/firmware.c index b33acff77f..b87d7da38f 100644 --- a/common/firmware.c +++ b/common/firmware.c @@ -224,9 +224,9 @@ out: static char *firmware_path; -const char *firmware_get_searchpath(void) +char *firmware_get_searchpath(void) { - return firmware_path; + return strdup(firmware_path); } void firmware_set_searchpath(const char *path) -- cgit v1.2.3