Actions
Bug #496
openMissing malloc check in libpayload
Start date:
06/27/2023
Due date:
% Done:
0%
Estimated time:
Affected versions:
Needs backport to:
Affected hardware:
ALL
Affected OS:
ALL
Description
libpayload in payload/libpayload/drivers/options.c::get_option_as_string does not issue a NULL check against malloc's return code.
Should there be a NOMEM error this may result in a NULL pointer deref or crash.
The following code extract illustrates the mentioned issue:
`
int get_option_as_string(const struct nvram_accessor *nvram, struct cb_cmos_option_table *option_table, char **dest, const char *name)
{
...
/* extra byte to ensure 0-terminated strings */
raw = malloc(cmos_length+1);
memset(raw, 0, cmos_length+1); <--- no check against malloc's return code
`
Actions