cmd: nfsdown: fix memory corruption with global memory free

Calling free() for result of getenv() causes memory corruption
because getenv() returns global memory area. Fix the corruption
with copying result of getenv() because parsing it with strtok()
changes the string.

Change-Id: I21374e7d622b603de9f8d3d036561d00b1e26c23
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

diff --git a/cmd/nfsdown.c b/cmd/nfsdown.c
index 949103d545a7281ea930572f9f879d50ddcb09c1..507a50f1d4e2c437f4dca0a7011bb2372666ab7d 100644 (file)
--- a/cmd/nfsdown.c
+++ b/cmd/nfsdown.c
@@ -334,7 +334,7 @@ static int do_nfs_to_fat(char *buf_addr, char *file_path, char *file_name,
 int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
        char *nfs_path;
-       char *buf;
+       char *tmp, *buf;
        char *line;
        char src_path[LEN_BUF];
        int size;
@@ -362,11 +362,18 @@ int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 
        set_dfu_alt_info();
 
-       buf = env_get("dfu_alt_info");
-       if (!buf) {
+       tmp = env_get("dfu_alt_info");
+       if (!tmp) {
                puts("No Default dfu_alt_info\n");
                return CMD_RET_FAILURE;
        }
+
+       buf = strdup(tmp);
+       if (!buf) {
+               puts("fail to parse dfu_alt_info\n");
+               return CMD_RET_FAILURE;
+       }
+
        printf("\ndfu_alt_info = %s\n", buf);
 
        ret = do_mmc_init(&mmc);