mtd: check the return value of malloc and pread
authorQiyuan Zhang <zhang.github@outlook.com>
Mon, 5 Aug 2024 10:47:21 +0000 (06:47 -0400)
committerRobert Marko <robimarko@gmail.com>
Tue, 31 Dec 2024 16:44:10 +0000 (17:44 +0100)
Check the return value of malloc and pread in case they fail.

Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
package/system/mtd/src/linksys_bootcount.c

index d22486203e90c115e098806ab17bfee323973b79..3ec0b61718c3d847a554fc8946a51e2ddee5442f 100644 (file)
@@ -106,17 +106,31 @@ int mtd_resetbc(const char *mtd)
        }
 
        num_bc = mtd_info.size / bc_offset_increment;
-        curr = malloc(bc_offset_increment);
+       curr = malloc(bc_offset_increment);
+
+       if(curr == NULL) {
+               DLOG_ERR("Failed to allocate %u bytes from memory.", bc_offset_increment);
+
+               retval = -6;
+               goto out;
+       }
 
        for (i = 0; i < num_bc; i++) {
-               pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+               ret = pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+
+               if(ret != sizeof(struct bootcounter)) {
+                       DLOG_ERR("Failed to read boot-count log at offset 0x%08x.", i * bc_offset_increment);
+
+                       retval = -5;
+                       goto out;
+               }
 
                /* Existing code assumes erase is to 0xff; left as-is (2019) */
                if (curr->magic == 0xffffffff)
                        break;
 
                if (curr->magic != BOOTCOUNT_MAGIC || curr->checksum != curr->magic + curr->count) {
-                       DLOG_ERR("Unexpected boot-count log at offset %08x: magic %08x boot count %08x checksum %08x; aborting.",
+                       DLOG_ERR("Unexpected boot-count log at offset 0x%08x: magic 0x%08x boot count 0x%08x checksum 0x%08x; aborting.",
                                 i * bc_offset_increment, curr->magic, curr->count, curr->checksum);
 
                        retval = -2;
@@ -179,7 +193,9 @@ int mtd_resetbc(const char *mtd)
        }
 
 out:
-       if (curr != NULL) free(curr);
+       if (curr != NULL)
+               free(curr);
+
        close(fd);
        return retval;
 }