From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Fri, 2 Dec 2022 05:30:22 +0000 (+0900)
Subject: bootspec: fix null-dereference-read
X-Git-Tag: v253-rc1~389
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=46dc071985ff487f5ccf20808531168a6add73d3;p=thirdparty%2Fsystemd.git

bootspec: fix null-dereference-read

Fixes [oss-fuzz#53578](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53578).
Fixes #25450.
---

diff --git a/src/shared/bootspec.c b/src/shared/bootspec.c
index 56274a0d4d3..83960b99d3f 100644
--- a/src/shared/bootspec.c
+++ b/src/shared/bootspec.c
@@ -980,6 +980,8 @@ static int boot_config_find(const BootConfig *config, const char *id) {
         if (id[0] == '@') {
                 if (!strcaseeq(id, "@saved"))
                         return -1;
+                if (!config->entry_selected)
+                        return -1;
                 id = config->entry_selected;
         }
 
diff --git a/test/fuzz/fuzz-bootspec/clusterfuzz-testcase-minimized-fuzz-bootspec-5731869371269120 b/test/fuzz/fuzz-bootspec/clusterfuzz-testcase-minimized-fuzz-bootspec-5731869371269120
new file mode 100644
index 00000000000..8804abd0945
--- /dev/null
+++ b/test/fuzz/fuzz-bootspec/clusterfuzz-testcase-minimized-fuzz-bootspec-5731869371269120
@@ -0,0 +1 @@
+{"config":"default @saved","loader":[""]}
\ No newline at end of file