From 07748a9be3b6e802ecbdf87b2a94ba7696b53aea Mon Sep 17 00:00:00 2001 From: Seung-Woo Kim Date: Wed, 2 Aug 2017 19:04:23 +0900 Subject: [PATCH] cmd: nfsdown: fix memory corruption with global memory free Calling free() for result of getenv() causes memory corruption because getenv() returns global memory area. Fix the corruption with copying result of getenv() because parsing it with strtok() changes the string. Change-Id: I21374e7d622b603de9f8d3d036561d00b1e26c23 Signed-off-by: Seung-Woo Kim --- cmd/nfsdown.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/cmd/nfsdown.c b/cmd/nfsdown.c index 36ea97469b..f8365206f6 100644 --- a/cmd/nfsdown.c +++ b/cmd/nfsdown.c @@ -334,7 +334,7 @@ static int do_nfs_to_fat(char *buf_addr, char *file_path, char *file_name, int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { char *nfs_path; - char *buf; + char *tmp, *buf; char *line; char src_path[LEN_BUF]; int size; @@ -362,11 +362,18 @@ int do_nfs_down(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) set_dfu_alt_info(); - buf = getenv("dfu_alt_info"); - if (!buf) { + tmp = getenv("dfu_alt_info"); + if (!tmp) { puts("No Default dfu_alt_info\n"); return CMD_RET_FAILURE; } + + buf = strdup(tmp); + if (!buf) { + puts("fail to parse dfu_alt_info\n"); + return CMD_RET_FAILURE; + } + printf("\ndfu_alt_info = %s\n", buf); ret = do_mmc_init(&mmc); -- 2.34.1