Project

General

Profile

Actions

Bug #496

open

Missing malloc check in libpayload

Added by Keith Makan over 1 year ago. Updated about 1 year ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Payloads
Target version:
Start date:
06/27/2023
Due date:
% Done:

0%

Estimated time:
Affected versions:
Needs backport to:
Affected hardware:
ALL
Affected OS:
ALL

Description

libpayload in payload/libpayload/drivers/options.c::get_option_as_string does not issue a NULL check against malloc's return code.
Should there be a NOMEM error this may result in a NULL pointer deref or crash.

The following code extract illustrates the mentioned issue:
`
int get_option_as_string(const struct nvram_accessor *nvram, struct cb_cmos_option_table *option_table, char **dest, const char *name)
{
...

/* extra byte to ensure 0-terminated strings */
raw = malloc(cmos_length+1);
memset(raw, 0, cmos_length+1); <--- no check against malloc's return code

`

Actions #1

Updated by Martin Roth about 1 year ago

  • Category set to Payloads
Actions

Also available in: Atom PDF