tools: fwumdata: Fix use-after-free in parse_config()

In parse_config(), devname is dynamically allocated by sscanf().
When sscanf() fails to fill enough fields (rc < 3), devname is freed and
the loop continues to the next line. However, if the next call to sscanf()
fails to match (rc == 0), devname is not written and still holds the stale
freed pointer. The subsequent free(devname) then operates on
already-freed memory.

Fix this by resetting devname to NULL before each sscanf() call, so
that a non-matching call leaves a NULL pointer and the subsequent
free() becomes a harmless no-op.

Reported-by: Coverity Scan
Link: https://lists.denx.de/pipermail/u-boot/2026-April/614161.html
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

diff --git a/tools/fwumdata_src/fwumdata.c b/tools/fwumdata_src/fwumdata.c
index c5b0f56842d2ed34cd7c3928e1726c2f9623c399..44195ce2bf2450fc38341c25f9bd10d2e217f53a 100644 (file)
--- a/tools/fwumdata_src/fwumdata.c
+++ b/tools/fwumdata_src/fwumdata.c
@@ -84,6 +84,7 @@ static int parse_config(const char *fname)
                if (line[0] == '#' || line[0] == '\n')
                        continue;
 
+               devname = NULL;
                rc = sscanf(line, "%ms %lli %lx %lx",
                            &devname,
                            &devices[i].devoff,