mtd: check malloc() return value in mtd_check()

After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.

Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23705
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

diff --git a/package/system/mtd/src/mtd.c b/package/system/mtd/src/mtd.c
index e0e1e2b1832c8d364a226f53e8df00ce033ede19..3a388c88104b76ac583419e68f52759b311838f3 100644 (file)
--- a/package/system/mtd/src/mtd.c
+++ b/package/system/mtd/src/mtd.c
@@ -269,6 +269,11 @@ static int mtd_check(const char *mtd)
 
                if (!buf)
                        buf = malloc(erasesize);
+               if (!buf) {
+                       close(fd);
+                       free(str);
+                       return 0;
+               }
 
                close(fd);
                mtd = next;