From be5af628bdc4df2fc85a2a753ff54616b7a8405c Mon Sep 17 00:00:00 2001 From: Angel Pons Date: Tue, 25 May 2021 13:03:24 +0200 Subject: dummyflasher.c: Prevent use-after-free bug The memory for the `status` string is aliased by the `endptr` pointer. Moreover, `errno` could have been modified by the call to `free()`. Therefore, only free the former when there are no more uses of either. Change-Id: I1b56834004fe18918213a7df0a09a8a7ecb56985 Signed-off-by: Angel Pons Reviewed-on: https://review.coreboot.org/c/flashrom/+/54909 Tested-by: build bot (Jenkins) Reviewed-by: Edward O'Callaghan Reviewed-by: Anastasia Klimchuk --- dummyflasher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dummyflasher.c b/dummyflasher.c index 5defec01..560dbdc0 100644 --- a/dummyflasher.c +++ b/dummyflasher.c @@ -962,12 +962,13 @@ int dummy_init(void) if (status) { errno = 0; data->emu_status = strtoul(status, &endptr, 0); - free(status); if (errno != 0 || status == endptr) { + free(status); msg_perr("Error: initial status register specified, " "but the value could not be converted.\n"); return 1; } + free(status); msg_pdbg("Initial status register is set to 0x%02x.\n", data->emu_status); } -- cgit v1.2.3