cmd: nfsdown: fix memory corruption with global memory free

Calling free() for result of getenv() causes memory corruption
because getenv() returns global memory area. Fix the corruption
with copying result of getenv() because parsing it with strtok()
changes the string.

Change-Id: I21374e7d622b603de9f8d3d036561d00b1e26c23
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

diff --git a/cmd/nfsdown.c b/cmd/nfsdown.c
index 36ea97469b21c2ba6113d01810fda9caadab39d9..f8365206f69b59433c381f382555560f9142f5e9 100644 (file)
--- a/cmd/nfsdown.c
+++ b/cmd/nfsdown.c
@@ -334,7 +334,7 @@ static int do_nfs_to_fat(char *buf_addr, char *file_path, char *file_name,
 int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
        char *nfs_path;
-       char *buf;
+       char *tmp, *buf;
        char *line;
        char src_path[LEN_BUF];
        int size;
@@ -362,11 +362,18 @@ int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 
        set_dfu_alt_info();
 
-       buf = getenv("dfu_alt_info");
-       if (!buf) {
+       tmp = getenv("dfu_alt_info");
+       if (!tmp) {
                puts("No Default dfu_alt_info\n");
                return CMD_RET_FAILURE;
        }
+
+       buf = strdup(tmp);
+       if (!buf) {
+               puts("fail to parse dfu_alt_info\n");
+               return CMD_RET_FAILURE;
+       }
+
        printf("\ndfu_alt_info = %s\n", buf);
 
        ret = do_mmc_init(&mmc);