From: Anna Kiri <bredcorn@gmail.com>
Date: Mon, 8 Jun 2026 09:06:32 +0000 (+0200)
Subject: mtd: check malloc() return value in mtd_check()
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F23705%2Fhead;p=thirdparty%2Fopenwrt.git

mtd: check malloc() return value in mtd_check()

After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.

Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23705
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
---

diff --git a/package/system/mtd/src/mtd.c b/package/system/mtd/src/mtd.c
index e0e1e2b1832..3a388c88104 100644
--- a/package/system/mtd/src/mtd.c
+++ b/package/system/mtd/src/mtd.c
@@ -269,6 +269,11 @@ static int mtd_check(const char *mtd)
 
 		if (!buf)
 			buf = malloc(erasesize);
+		if (!buf) {
+			close(fd);
+			free(str);
+			return 0;
+		}
 
 		close(fd);
 		mtd = next;