From 2818ac5ccd0cc7c44176010691929b843b7cb566 Mon Sep 17 00:00:00 2001 From: Anna Kiri Date: Mon, 8 Jun 2026 11:06:32 +0200 Subject: [PATCH] mtd: check malloc() return value in mtd_check() After malloc(erasesize) in mtd_check(), the result was never checked for NULL. On allocation failure, the buf pointer remained NULL and would later be used in image_check() via read(imagefd, buf + buflen, ...), causing a NULL pointer dereference. Add a NULL check after the allocation and return early. The early return path also closes the just-opened fd and frees the strdup'd colon-separated device-list copy to avoid leaks. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23705 Signed-off-by: Jonas Jelonek --- package/system/mtd/src/mtd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/package/system/mtd/src/mtd.c b/package/system/mtd/src/mtd.c index e0e1e2b1832..3a388c88104 100644 --- a/package/system/mtd/src/mtd.c +++ b/package/system/mtd/src/mtd.c @@ -269,6 +269,11 @@ static int mtd_check(const char *mtd) if (!buf) buf = malloc(erasesize); + if (!buf) { + close(fd); + free(str); + return 0; + } close(fd); mtd = next; -- 2.47.3