From: Seung-Woo Kim <sw0312.kim@samsung.com>
Date: Wed, 2 Aug 2017 10:04:23 +0000 (+0900)
Subject: cmd: nfsdown: fix memory corruption with global memory free
X-Git-Tag: submit/tizen/20170808.230223~7
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F58%2F142058%2F2;p=platform%2Fkernel%2Fu-boot.git

cmd: nfsdown: fix memory corruption with global memory free

Calling free() for result of getenv() causes memory corruption
because getenv() returns global memory area. Fix the corruption
with copying result of getenv() because parsing it with strtok()
changes the string.

Change-Id: I21374e7d622b603de9f8d3d036561d00b1e26c23
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
---

diff --git a/cmd/nfsdown.c b/cmd/nfsdown.c
index 36ea97469b..f8365206f6 100644
--- a/cmd/nfsdown.c
+++ b/cmd/nfsdown.c
@@ -334,7 +334,7 @@ static int do_nfs_to_fat(char *buf_addr, char *file_path, char *file_name,
 int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	char *nfs_path;
-	char *buf;
+	char *tmp, *buf;
 	char *line;
 	char src_path[LEN_BUF];
 	int size;
@@ -362,11 +362,18 @@ int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 
 	set_dfu_alt_info();
 
-	buf = getenv("dfu_alt_info");
-	if (!buf) {
+	tmp = getenv("dfu_alt_info");
+	if (!tmp) {
 		puts("No Default dfu_alt_info\n");
 		return CMD_RET_FAILURE;
 	}
+
+	buf = strdup(tmp);
+	if (!buf) {
+		puts("fail to parse dfu_alt_info\n");
+		return CMD_RET_FAILURE;
+	}
+
 	printf("\ndfu_alt_info = %s\n", buf);
 
 	ret = do_mmc_init(&mmc);