From: Ladi Prosek Date: Wed, 20 Sep 2017 09:52:16 +0000 (+0200) Subject: [crypto] Fail fast if cross-certificate source is empty X-Git-Tag: v1.20.1~144 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0631a46a94fdf86992f18b50921c42e42a822bab;p=thirdparty%2Fipxe.git [crypto] Fail fast if cross-certificate source is empty In fully self-contained deployments it may be desirable to build iPXE with an empty CROSSCERT source to avoid talking to external services. Add an explicit check for this case and make validator_start_download fail immediately if the base URI is empty. Signed-off-by: Ladi Prosek Modified-by: Michael Brown Signed-off-by: Michael Brown --- diff --git a/src/net/validator.c b/src/net/validator.c index 52845b6ed..68abe1b55 100644 --- a/src/net/validator.c +++ b/src/net/validator.c @@ -239,6 +239,10 @@ static int validator_start_download ( struct validator *validator, /* Determine cross-signed certificate source */ fetch_string_setting_copy ( NULL, &crosscert_setting, &crosscert_copy ); crosscert = ( crosscert_copy ? crosscert_copy : crosscert_default ); + if ( ! crosscert[0] ) { + rc = -EINVAL; + goto err_check_uri_string; + } /* Allocate URI string */ uri_string_len = ( strlen ( crosscert ) + 22 /* "/%08x.der?subject=" */ @@ -277,6 +281,7 @@ static int validator_start_download ( struct validator *validator, err_open_uri_string: free ( uri_string ); err_alloc_uri_string: + err_check_uri_string: free ( crosscert_copy ); return rc; }