coreboot

libpayload in payload/libpayload/drivers/options.c::get_option_as_string does not issue a NULL check against malloc's return code.
Should there be a NOMEM error this may result in a NULL pointer deref or crash.

The following code extract illustrates the mentioned issue:
`
int get_option_as_string(const struct nvram_accessor *nvram, struct cb_cmos_option_table *option_table, char **dest, const char *name)
{
...

/* extra byte to ensure 0-terminated strings */
raw = malloc(cmos_length+1);
memset(raw, 0, cmos_length+1); <--- no check against malloc's return code

`