From: Qiyuan Zhang <zhang.github@outlook.com>
Date: Mon, 5 Aug 2024 10:47:21 +0000 (-0400)
Subject: mtd: check the return value of malloc and pread
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=d6459091fd262446fcf98ebe7d33c5615ebf8d41;p=openwrt%2Fopenwrt.git

mtd: check the return value of malloc and pread

Check the return value of malloc and pread in case they fail.

Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
---

diff --git a/package/system/mtd/src/linksys_bootcount.c b/package/system/mtd/src/linksys_bootcount.c
index d22486203e..3ec0b61718 100644
--- a/package/system/mtd/src/linksys_bootcount.c
+++ b/package/system/mtd/src/linksys_bootcount.c
@@ -106,17 +106,31 @@ int mtd_resetbc(const char *mtd)
 	}
 
 	num_bc = mtd_info.size / bc_offset_increment;
-        curr = malloc(bc_offset_increment);
+	curr = malloc(bc_offset_increment);
+
+	if(curr == NULL) {
+		DLOG_ERR("Failed to allocate %u bytes from memory.", bc_offset_increment);
+
+		retval = -6;
+		goto out;
+	}
 
 	for (i = 0; i < num_bc; i++) {
-		pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+		ret = pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+
+		if(ret != sizeof(struct bootcounter)) {
+			DLOG_ERR("Failed to read boot-count log at offset 0x%08x.", i * bc_offset_increment);
+
+			retval = -5;
+			goto out;
+		}
 
 		/* Existing code assumes erase is to 0xff; left as-is (2019) */
 		if (curr->magic == 0xffffffff)
 			break;
 
 		if (curr->magic != BOOTCOUNT_MAGIC || curr->checksum != curr->magic + curr->count) {
-			DLOG_ERR("Unexpected boot-count log at offset %08x: magic %08x boot count %08x checksum %08x; aborting.",
+			DLOG_ERR("Unexpected boot-count log at offset 0x%08x: magic 0x%08x boot count 0x%08x checksum 0x%08x; aborting.",
 				 i * bc_offset_increment, curr->magic, curr->count, curr->checksum);
 
 			retval = -2;
@@ -179,7 +193,9 @@ int mtd_resetbc(const char *mtd)
 	}
 
 out:
-	if (curr != NULL) free(curr);
+	if (curr != NULL)
+		free(curr);
+
 	close(fd);
 	return retval;
 }